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Decision 

In the administrative proceedings 

1. Facebook Inc., [...], Menlo Park, [...], U.S.A. 

Party under 1. - 

2. Facebook Ireland Ltd., [...], Dublin, Ireland, 

Party under 2. - 

3. Facebook Deutschland GmbH, [...], Hamburg 

Party under 3. - 

Authorised representatives of 1.-3.: 

[...] 

4. Verbraucherzentrale Bundesverband e.V., [...] Berlin 

- Third parties admitted to the proceedings - 
the 6th Decision Division of the Bundeskartellamt has decided on 6 February 2019: 
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1. The parties 1-3, including any associated companies pursuant to Section 36(2) GWB, 
are prohibited from using terms of service including specific provisions of data and 
cookie policies and similar contractual terms which stipulate that the private use by 
users^ residing in Germany of the service available under the web addresses 
facebook.com and facebook.de and via the mobile “Facebook” app (both offers 
hereinafter referred to as Facebook.com) is conditional on the following: 

a. Facebook.com’s operating company can collect user and device-related data 
collected and saved from private users residing in Germany when using 
WhatsApp, Oculus and Masquerade and - without the user’s consent - combine 
these data with their data collected and saved while using Facebook.com and 
use the data; 

b. Facebook.com's operating company can - without the user’s consent - combine 
user and device-related data collected from private users residing in Germany 
when using Instagram with their data collected and saved while using 
Facebook.com and use the combined data; 

c. Facebook.com’s operating company or a corporate provider of the programming 
interfaces {Facebook Business Tools) can - without the user’s consent - collect 
any user or device-related data from users residing in Germany via programming 
interfaces that are integrated into websites or apps to create social plugins, 
Facebook Login and Account Kit, as well as measurement and analysis services 
based on Facebook Pixel and Facebook SDK, when users use websites or 
mobile apps by third-party providers, combine the data with data collected in the 
context of the use of Facebook.com and use the data ; 

where, in particular, the first paragraph of section 2 of the current terms of service {“Our 
Data Policy and Your Privacy Choices’’), which contains provisions stating that personal 
data is collected and used to provide the services and that the user can refer to the 
data policy to learn how his data is collected and used, is specified by the following 
guidelines: 

the provision which is currently section I of the printable version of the Facebook 
Data Policy (“What kinds of information do we collect?’’) explains that the 
collection of information provided by the user, device-related information and 
information provided by partners applies to all so-called “Facebook Products”, 
which include, according to the given definition, all products of the Facebook 
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group including corporate services and Facebook Business Tools, which are used 
by so-called “Facebook Partners” to send information; 

the provision currently contained in section II of the printable version of 
Facebook’s Data Policy under the headline “How do we use this information? - 
Provide, personaiize and improve our Products", bullet point “information across 
Facebook Products and devices", explains that the data collected are used across 
all Facebook Products for provision and personalisation, including information on 
the users’ activities on various Facebook Products and devices, to provide the 
user with a tailored and consistent experience on all Facebook Products wherever 
they are used; 

the provision currently contained in section II of Facebook’s Data Policy under the 
headline “/-/ow do we use this information? Provide measurement, anaiytics, and 
other business services" explains that the available information including activities 
outside of Facebook Products, e.g. websites visited and ads viewed is used to 
help advertisers and other partners measure the effectiveness and distribution of 
their ads and services and understand the types of people who use their services 
and how people interact with their websites, apps, and services; 

the provision currently contained in section II of Facebook’s Data Policy under the 
headline “Promote safety, integrity and security’, “Communicate with yoU’, 
“Research and innovate for sociai good’ explains that the available information is 
used to promote protection, integrity and security, to communicate with the user 
and to research and innovate for social good; 

the provision currently contained in section IV of the printable version of 
Facebook’s Data Policy under the headline “How do the Facebook Companies 
work together?’ explains that information on the user is processed across the so- 
called “Facebook Companies” as permitted by applicable law and in accordance 
with their terms and policies to provide an innovative, relevant, consistent and 
safe experience across all products provided by the Facebook Companies, which, 
pursuant to this provision, include Oculus and Oculus Ireland Ltd., WhatsApp Inc. 
and WhatsApp Ireland Ltd., and Masquerade; 

the provision currently contained in Facebook’s Cookies Policy under the headline 
“Where do we use cookies", which is referred to in the Data Policy {“What kinds 
of information do we coiiect - Device information"), explains that Facebook places 
cookies on the computers or devices to receive information stored in cookies 
when the user uses or visits Facebook Products, Products provided by other 
members of the Facebook Companies and websites and apps provided by other 
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companies that use the Facebook Products including Facebook Business Tools, 
and stipulates that Facebook receives this information including device-related 
information and information on the user’s activities without any further user action 
once the user visits websites and apps meeting the criteria specified above; 

the definition currently given in Facebook’s Cookies Policy under the headline 
“Cookies & Other Storage Technologies" extending the aforementioned 
provisions on the use of cookies to other technologies, including the data saved 
by Facebook on the user’s web browser or device, identifiers linked to that device 
and other software. 

2. The parties 1 -3, including any affiliated companies pursuant to Section 36(2) GWB, are 
prohibited from implementing the Facebook terms of service including the Facebook 
data and cookies policies within the meaning of paras 1 .a. to c., in particular as far as 
the following aspects are concerned: 

a. Collection of the phone number indicated by private users upon registration for 
WhatsApp, their device identifications, operating system versions, app versions, 
platform information, country code, network code, identifiers allowing to track the 
user’s agreement with updates and control options and information on when 
WhatsApp was last used, information on when the account was registered and how 
and how frequently features were used, and other user and device-related 
information, and combination of this information with data collected and saved while 
the users were using Facebook.com, e.g. via a family device ID and matching the 
information with the users’ Facebook IDs, and use of that information. 

b Collection of the user and device-related information of private users of Oculus and 
Masquerade, e.g. account information, content created, meta data, transaction 
data, payment information, device information, device IDs, cookie and pixel 
information, information on the use of third-party websites or apps and location data 
and combination of this information with data collected during their use of 
Facebook.com, e.g. via Facebook Login, the user’s email address or device IDs, 
and matching this information with their Facebook IDs, and use of that information. 

c. The combination of information and content provided by private users of Instagram, 
their networks and connections on Instagram, information on their use of Instagram, 
transactions carried out on Instagram, other people’s activities and information 
others provided on a user, information on the terminal device used for accessing 
Instagram including device attributes, processes on the device, identifiers, device 
signals, data from the device settings, network and connections, cookie data and 
information provided by partners of Instagram with data collected and stored during 
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their use of Facebook.com, e.g. via a family device ID and matching this information 
with the users’ Facebook IDs, and use of that information. 

d. Collection of private users’ device information, information on websites visited, 
purchases made, advertisements viewed and information on usage collected via 
Facebook Business Tools which are used by advertisers, app developers and 
publishers (“Facebook Partners”) via the following APIs, 

- If social plugins are integrated by Facebook Partners to collect, in 
particular, the IP address, the browser type, the URL, the website visited 
and the time of visit, as well as the user ID, which is retrieved from the 
cookie, the website, date and time; if an app is integrated the collection of 
information on the app provider, the app ID, the operating system used, 
the device model, screen size, processor cores, total storage space, name 
and version of the app used, the so-called “User-Agent-String” (browser 
information), IP address, time zone and the corresponding “SDK events”. 

- If Facebook Login and Account Kit are integrated by Facebook Partners 
to collect the same amount of data as with social plugins for websites and 
mobile apps plus, in particular, login information the users enter manually, 
as well as error messages containing the user ID. 

- If pixel and SDK-based measurement and analysis services are integrated 
by Facebook Partners to collect, in particular, the http header’s data set, 
IP addresses, browser information, site storage location, document 
information, referrer (website via which the user accessed the current 
website), information on the user, pixel-specific data like the pixel ID and 
the Facebook cookie, click data and configured “events”, device 
information including the advertising ID, cookie data and hashed user 
identifiers 

and its combination with data collected and saved while these users were using 
Facebook.com, e.g. via cookie data, device IDs, a comparison of further device- 
related data, hashed user IDs in the context of “advanced matching” by matching 
this information with the Facebook ID, and its use. 


3. The parties 1 -3, including any affiliated companies pursuant to Section 36(2) GWB, are 
obliged to implement the following remedies to terminate the conduct prohibited in 
paragraphs 1 and 2: 
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a. Terminate or adjust the contractual terms prohibited in paragraph 1 and the 
implementation of contractual terms prohibited in paragraph 2 within 12 (twelve) 
months. 

b. Within 12 (twelve) months after the date of enforceability of the decision, when 
adjusting the terms and conditions, also in the Facebook terms of service and data 
policies or similar documents specifying them, expressly clarify the following: 

- Collection of private and device-related user data from WhatsApp, Oculus 
and Masquerade and combination with data collected and stored from 
their use of Facebook is subject to the user’s consent and will not take 
place without it. 

- Collection of private and device-related user data from Instagram and 
combination with data collected and stored from their use of Facebook and 
use for Facebook.com is subject to the user’s consent and will not take 
place without it. 

- Collection of private user and device-related data from websites or mobile 
apps via Facebook Business Tools and combination with the data 
collected and stored from their use of Facebook and use for 
Facebook.com is subject to the user’s consent and will not take place 
without it. 

c. Present within 4 (four) months an implementation plan detailing which measures 
the parties intend to take to fulfil the obligations under paragraph 3 and in which 
steps and at which points in time these measures will be implemented. 

4. Users are not deemed to have given their consent within the meaning of paragraphs 1 
to 3 if the provision of the Facebook.com service is conditional on the users' consent 
to the collection and combination of data. 

5. If a request to restore the suspensive effect of the appeal pursuant to Section 65(3) 
sentence 3 GWB is filed within a period of 2 (two) months upon receipt of the decision, 
the deadlines for implementation stipulated in paragraphs 3.a. to c. are extended once 
by 2 months. The suspension begins upon receipt of the request by the appeal court 
and ends upon termination of the expedited proceedings on this request at first 
instance. 

6. The administrative fee for the proceedings, including this decision, amounts to [...] and 
is payable by the parties to the proceedings. 

7. The Bundeskartellamt reserves the right to revoke paragraphs 1 to 6 of this decision in 
full or in part. 
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Reasons: 


A. Statement of facts 
I. Facebook 

1. The Facebook group 

1 The Facebook group develops and operates various digital products, online services 
and applications for smartphones (hereinafter: apps). Facebook’s parent company is 
Facebook Inc., which is headquartered in Menlo Park/USA. Hamburg-based Facebook 
Germany GmbH and Dublin-based Facebook Ireland Ltd. are wholly-owned 
subsidiaries of Facebook Inc. (all companies together are hereinafter referred to as 
Facebook). 

2 Facebook Inc. is owned by a large number of different investors. The largest share 
(28%) is held by the company's co-founder and chairman of the Board of Directors, 
Mark Zuckerberg. Further shareholders are Facebook co-founders Dustin Moskovitz 
and Eduardo Saverin. Facebook employees hold another large part of (free float) 
shares. The remaining shares are also held by a large number of investors. 

3 The company’s products include the “Facebook” service, which was developed by Mark 
Zuckerberg and is financed through advertising. It comprises the “Facebook 
Messenger” communication service and other products offered under 
www.facebook.com (also accessible in Germany viawww.facebook.de, which forwards 
the query to www.facebook.com). The service is hereinafter referred to as 
Facebook.com, which is specified under 2. According to the impressum, the 
European provider of the Facebook.com services is Facebook Ireland Ltd.^ 

4 Besides Facebook.com, Facebook also offers the instagram service, which was 
previously operated by the separate group Instagram Inc., San Francisco/USA.^ 
Facebook acquired Instagram Inc. in 2012. Since 25 May 2018 Instagram has been 
operated by Facebook Ireland Ltd. too. Instagram is a mostly mobile service for sharing 
photos and videos (see details under 3.). 

5 The business purpose of Facebook Germany GmbH is to support Facebook Ireland 
Ltd. in the areas of advertising, communications and public relations work."^ Facebook 


^ https://www.facebook.com/leaal/terms?ref=pf , [...] 

3 [...] 

Excerpt from the German register of companies, ref. HRB 111963: “The purpose of this company is to support 
the online network platform Facebook by providing any type of services in the areas of sales, marketing, 
commercial development, technology research and development, public relations and communications as well 


4 
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Payments Inc., Menlo Park/USA®, which supports payments made in various Facebook 
services, is part of the Facebook group too. 

6 In addition to that, the Facebook group owns further subsidiaries, which also offer 
online services and apps: 

7 First of all, WhatsApp Inc., Menlo Park/USA offers the “WhatsApp” mobile app via its 
Irish subsidiary WhatsApp Ireland Ltd., Dublin. The WhatsApp communication service 
was launched in 2010 and acquired by Facebook Inc. in 2014. WhatsApp users can 
exchange text messages, pictures, videos, audio files, locations, documents and 
contacts, both between individual users and in groups (see details under 4 below). 

8 In 2016 Facebook acquired Minsk-based Masquerade Technologies Inc., which 
offers the “Masquerade” (MSQRD) app for editing and sharing pictures with filters and 
masks. Masquerade is used by [...] people in Germany each month.® 

9 Facebook Technologies LLC (formerly Oculus VR, LLC), Menlo Park/USA^ specialises 
in developing “Virtual Reality” headsets. It manufactures the hardware required for 
virtual reality products like the VR headsets Rift and Gear VR and operates a platform 
for users to upload or download contents like virtual reality games. In Europe these 
products are provided by Facebook Technologies Ireland Ltd. [...] people in Germany 
use Oculus Rift and Oculus Gear each month.® 

10 Facebook Inc. has owned the Israeli company Onavo Inc.® since 2013. The latter offers 
mobile apps optimising the use of memory and data plans (“Onavo Extend”) by 
identifying the apps which require the largest data volume, and mobile apps to protect 
private data when using public WiFi networks (“Onavo Protect”, hereinafter: Onavo). 
The company also offers “Onavo Insights”, which provides companies with analytical 
data on the use of apps and consumer trends in the areas of online gaming, social 
networks, finances and entertainment. 

11 Facebook Inc. acquired the analysis service CrowdTangle Inc. in 2016. Among other 
things, the service shows companies how to spread their content online and how such 
content becomes “viral”. 


as any other commercial, administrative or IT-related service to the Facebook group" (Bundeskartellamt 
unofficial translation, original version accessed on 21 March 2017, [...]. 

® of. https://www.facebook.com/payments_terms/privacy Version: 30 December 2013, [...] 

6 [...] 

^ httDs://www.oculus.com/ : f...1 
B [...] 

3 Cf. http://www.onavo.com/privacv policy/ , Version of 14 December 2018,[...]; the data policy having been 
modified, data processing from this service is no longer subject of the proceedings. 
http://www.crowdtanale.com/features , f...1 
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12 In 2014 Facebook Inc. acquired the Finnish company ProtoGeo Oy, which operated 
the mobile fitness app Moves with a patented algorithm. The app created an exact 
motion profile of each user and gave an overview of the calories used and distances 
covered. According to Facebook’s statements, this app was withdrawn from the market 
effective 31 July 2018.^^ 

13 The total turnover of Facebook Inc., 98%^^ of which was generated through advertising, 
amounted to approx. 55 billion US dollars in 2018^^. 

2. Facebook.com 

14 Under the umbrella of Facebook.com, the Facebook group provides a range of 
products and services addressing various groups.Its offers include the social network 
Facebook, which primarily addresses private users and publishers (see a.). For 
advertisers Facebook offers various products linked to the social network and other 
services of the Facebook group (see b). In addition, Facebook.com includes the 
Facebook developer platform (“Facebook for Developers”), which offers third-party 
companies further software products and programming interfaces for developing their 
services, i.a. via “Facebook Business Tools” (see c.). 

a. Social network 

15 Facebook’s core product is its social network, which can be accessed in Germany via 
www.facebook.de and www.facebook.com . Facebook’s social network was founded in 
2004 by a group of students including Mark Zuckerberg. It has been available in 
Germany since 2008. 

16 The network’s user numbers have been rising continuously since its foundation. 
Facebook has various ways of determining its user numbers: It indicates both its daily 
active users (DAU) and its monthly active users (MAU). Daily active users are defined 
as registered Facebook users logging on to Facebook.com either via the website or a 
mobile device to browse the site, or as registered Facebook users using the Facebook 
Messenger App, on a given day.^® Monthly active users are defined as registered 
Facebook users who in the last 30 days have logged on to Facebook.com either via 


https://newsroom.fb.eom/news/2018/07/hello-tbh-movinq-on/ , [...] 

Facebook, 2017 Annual Report, p. 9 (downloadable from 

https://s21.a4cdn.com/399680738/flles/doc financlals/annual reports/FB AR 2017 FINAL.pdf, [...] 

Facebook, Facebook Reports Fourth Quarter and Full Year 2018 Results , [...] 

[...] 

[...] 


15 
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the website or a mobile device to browse the site, or as registered Facebook users 
using the Facebook Messenger App.^® 

17 In December 2018 Facebook had 1.52 billion daily active users and 2.32 billion monthly 
active users.In November 2018 the number of users in Germany was still increasing, 
with 23 million daily active users and 32 million monthly active users. 

18 The network and its various functions are mostly used by private users (see (1). It is 
also used by commercial publishers (see (2). 

(1) Private user applications 

19 German users can access Facebook.com either via their browsers, typing in the 
address www.facebook.com or www.facebook.de , or via the Facebook app on their 
mobile devices. The company does not charge a monetary fee for using Facebook.com 
or downloading the app. 

20 Facebook.com offers private users a range of functions to connect with their friends 
and acquaintances and share contents with them. Facebook describes the key 
functions of its social network as “connect”, “communicate”, “share”, and “discover”. 

21 Private Facebook.com use is subject to registration by creating a user profile. Users 
create their own profiles which are the basis for their personal Facebook sites. Using 
their real names, users can enter information on themselves and set a profile picture. 
Additionally, users can enter information on their relationship status, current place of 
residence, past and present workplaces, interests and religious and political views. 
Based on this information, Facebook.com creates a personalised site for each user, 
which is subdivided into three subsites: the profile page, the start page and the “find 
friends” page. 

22 Besides the personal information users enter, the profile page also contains the 
“timeline”, which has been available in Germany since 2011. It lists and displays all 
activities of each user in an inverted chronological order along a timeline. It also 
contains a list of “friends”, i.e. a list of people with their real names and profile pictures 
with whom the user is connected in the social network. Users can determine which type 
of information is visible for whom. 


16 [...] 

1^ Facebook, Facebook Reports Fourth Quarter and Full Year 2018 Results , [...] 

16 https://allfacebook.de/zahlen_fakten/offiziell-facebook-nutzerzahlen-deutschland (in German, iast accessed on 
10 January 2019); [...] 

[...] 


19 
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23 The “find friends” page allows users to find people by applying targeted search 
parameters (name, place of residence, school, employer). Facebook.com also applies 
an algorithm to suggest people the user probably knows as potential new “friends”. 
Users can also upload their e-mail directories or the contact lists on their smartphones 
to find registered Facebook users. To connect with other Facebook users, they have to 
send a friendship request which the respective user can accept or decline. 

24 Users can also found or join groups. Groups are networks which have been set up to 
discuss mutual interests or to meet specific communication requirements. Their 
visibility can be restricted to members (secret groups), group membership can be 
subject to approval by a moderator and any comment made in such a group is not 
publicly visible (closed groups), or they can be open to everyone and all comments are 
public (open groups). Each group belongs to a certain category, e.g. hobbies and 
interests, sports, school and education, buy and sell, etc. 

25 The start page is the central communication area. It contains the “news feed” displaying 
recent information (“posts”) provided by the users’ friends or by publishers and 
companies (see (2) below) which the user either subscribed to or which he marked by 
clicking on the “like” button. An algorithm sorts the posts in the news feed by relevance 
for each user based on his data. 

26 The users’ own “status reports” are a key feature of the news feed. Users can choose 
to share their own posts with friends (and messenger contacts) or the general public. 
Depending on their relevance, these posts then appear either in the friends’ news feeds 
or across the entire network. Users can share their thoughts and include, e.g., a picture, 
a video or their current location. They can also select an activity (e.g. “feeling”, 
“watching”, “reading”, “listening to” etc.) from a long list and further illustrate their mood 
by choosing from a large variety of “emoticons” (smileys to match their current mood). 
Users can also integrate third-party content by clicking on a “social plugin” (e.g. “Like” 
or “Share”) on external websites or apps. By doing so, they create a hyperlink with 
website preview in their friends’ personal newsfeed for them to comment on or share 
with others. 

27 Users can also communicate bilaterally or in small groups in real time via the Facebook 
Messenger (“chats” and “chat rooms”) exchanging text messages, photos, videos or 
audio files. The Messenger can also be used for voice and video calls. Since 2011 
Facebook Messenger has been offered as a messaging tool for Facebook.com users 
as part of the social network. It is a part of the service which is pre-installed in the 
desktop version of the Facebook website and exclusively accessible via 
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Facebook.com. The Messenger has been available as a separate app for mobile 
devices since 2014^°, also for users who do not have a Facebook account. 

28 Since August 2017 Facebook has also been offering Facebook Marketplace as a sales 
platform which can be accessed via the social network’s start page. Users can create 
free classifieds to buy or sell (used) things.^^ Facebook Marketplace is a supplement 
to users’ sales activities in the buy and sell groups mentioned above. 

29 Facebook offers further functionalities through its social network, e.g. event 
organisation, job search, weather forecasts or fundraisers. There are plans to include 
a dating function and a video-on-demand platform (Facebook Watch) in future. 
Facebook Watch is already available in the USA. 

30 Private users are also offered a variety of apps created by third-party providers on the 
basis of a developer platform. Apps developed for Facebook by third-party providers 
are available to users of the social network via the “App Center”. Such apps are mostly 
games of all kinds which can be played as “Instant Games” on Facebook.com, some 
of them interactively with other users. There is also a separate app, “Gameroom”, which 
can be installed on computers or mobile devices to continue the game with the 
achieved score on several devices. A Facebook account is required for using the app. 

31 Any payment required by Facebook.com, e.g. in-app purchases in games or 
fundraisers, is to be made with “Facebook Payments”. Facebook Payments supports 
various forms of payment like credit or debit cards, Facebook coupons or payments via 
the mobile virtual network operator.^^ In return for its services Facebook receives a 
share of the revenues from the providers. 

(2) Publisher applications 

32 Facebook offers publishers the opportunity to use the social network as a space for 
publishing their own contents. For this purpose, companies, associations or individuals 
can create their own Facebook “pages” free of charge. Publishers can spread their 
contents on Facebook, connect with users through “subscriptions” and “likes”, and 
increase their reach as a result. 

33 Operating a Facebook business page is subject to registration with either a personal 
Facebook account or a “Business Manager” account. When creating its site, a 


2 ° [...] 

2^ https://www.heise.de/newsticker/meldunq/Facebook-Flohmarkt-IVlarketplace-startet-in-Deutschland- 

3801730.htmi (iast accessed on 10 January 2019). 

22 Cf. https://www.facebook.com/pavments terms , [...1 

22 Cf. https://www.facebook.com/business/iearn/how-business-manaaer-works/auide . [...] 
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business can choose from the categories “company or brand” and “community or public 
figure”, each with various subcategories, and set up its page in a way that is similar to 
users’ personal pages. By communicating on Facebook.com, e.g. by “sharing” contents 
with the personal network, site contents can be spread. 

34 Users who have subscribed to a business site receive the contents published by that 
business in their newsfeeds. Publishers can use “Instant Articles” to host their contents 
directly on Facebook.com, making it unnecessary to redirect users to the general 
website Facebook.com in order to read an article or watch a video. The content is 
therefore readily and quickly available to users, and the users stay on the Facebook 
platform. 

35 Publishers can also advertise and monetise their content by using the Facebook ads 
manager for Facebook.com or the Facebook Audience Network (see b. below) for their 
websites. By integrating “Facebook Analytics” and using further Facebook 
measurement and analysis tools (see c. below), companies can access the information 
Facebook collected on user behaviour with regard to their contents^"^ and thus optimise 
their interactions and advertising activities. 

36 According to publicly available figures, approx. 70 million companies worldwide used 
the Facebook pages in the fourth quarter of 2017.^^ 

b. Online advertising 

37 Facebook uses online advertising to fund its social network. Advertisements can be 
published on Facebook.com, Facebook Messenger, Instagram or on third-party 
websites which are part of Facebook’s advertising network (the “Facebook Audience 
Network”) via the so-called Audience Network SDK. The ads match a user’s individual 
profile. The aim is to present the user with ads that are potentially interesting to him 
based on his personal commercial behaviour, his interests, purchasing power and living 
conditions (“targeting”, “targeted advertising”, “interest-based advertising”, 
“personalised advertising”). In December 2018 the “Average Revenue per User” 
(ARPU) per quarter was 10.98 US dollars in Europe and 7.37 US dollars worldwide.^® 


2 ^ [...] 

25 Cf. https://allfacebook.de/toll/state-of-facebook ; figures relating to Germany are confidential. 

25 Facebook, Facebook Reports Fourth Quarter and Full Year 2018 Results, 

https://s21 .a4cdn.com/399680738/files/doc financials/2018/Q4/Q4-201 S-Earninas-Presentation.pdf, [...] 
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(1) Advertising on Facebook 

38 Advertising on Facebook.com is subject to registration with a personalised Facebook 
account or a Business Manager account and a Facebook “page”. Advertising 
customers can create their ad campaign using the “Ads Manager”. They can specify 
their advertising objectives and audience. 

39 Via the ads manager advertisers can decide where to place their ads or rely on 
Facebook.com to place the advertisement automatically wherever it is most likely to 
achieve the best results.^^Advertising space is available on Facebook’s social network 
and the Messenger. Advertisements are displayed both in the users’ newsfeeds, where 
they are marked as “sponsored”, and in the right column of the users’ start page. If 
requested, users can be redirected directly to the online shop by clicking on the 
advertisement. 

40 Since 2014 there have been additional advertising opportunities on Instagram, and 
further opportunities will be available on WhatsApp as of 2019.^® Advertisements can 
also be spread via third-party websites and apps outside Facebook if they are 
connected to the Facebook Audience Network. Facebook acts as an agent between 
advertisers and third-party websites or apps and thus expands the Facebook group’s 
scope of advertising with this network. Facebook’s agency services are subject to a 
commission paid by the advertisers. 

41 Further advertising space is available in the form of instant articles and in-stream 
videos displaying advertisements when users view media contents.In addition to 
that, Facebook App Ads gives mobile app providers the opportunity to advertise their 
apps on Facebook.com, Instagram or the Facebook Audience Network. The 
advertisement contains a direct link to Apple’s app store, Google’s PlayStore or 
Kindle’s Fire Store, where the mobile app can be downloaded. App Ads can also be 
used to once again specifically contact those users who have already downloaded an 
app to entice them to carry out further activities in the app.^° 

42 Advertisers can set the budget and timeline for their campaigns and create their 
contents by selecting a format, uploading photos and deciding on the content. The 
decision of which advertising space to allocate to whom is made in an auction 


2® https://www.heise.de/newsticker/meldunqAA/erbunq-bei-WhatsApp-Jetzt-wird-Geld-verdient-4128652.html , in 

German, last accessed on 10 January 2019). 

see information provided by Facebook in its advertising manager under “Placements for an Ad”. 
https://de-de.facebook.com/business/learn/facebook-create-ad-app-install-enqaqement . [...] 


30 
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process.Advertising products are paid for based on “cost per click”, “cost per action” 
or “cost per thousand impressions (CPM)”.^^ 

(2) Targeting and refining audiences 

43 Facebook offers various options to refine the criteria for a target audience for each ad. 

44 Audiences can be specified based on their location, age, sex, language and other 
demographic data, interests and behaviour in the Ads Manager. The location can be 
further specified based on the following criteria: „Everyone in this location", „People 
who live in this location", „People recently in this location", „People travelling in this 
location". Age can be specified by exact age categories, with 13 being the minimum 
age and 65+ being the highest age category. The following subcategories are available 
for demographic data: “Education", “Financial”, “Generation”, “Home”, “Life Events”, 
“Parents”, “Politics”, ’’Relationship”. “Interests” are further specified as “Business and 
Industry”, “Shopping and fashion”, “Food and drink”, “Family and relationships”, 
“Fitness and wellness”, “Hobbies and activities”, “Sports and outdoors”, “Technology”, 
and “Entertainment”. “Behaviours” are categorised as “Automotive”, “Digital activities”, 
“Expats”, “Financial”, “Anniversary”, “Purchase behaviour”, “Consumer classification”, 
“Multicultural affinity”, “Mobile device user”, “Travel”, “Residential profiles”, “Seasonal 
and events”, “Home owners”, etc. Each of these categories can be further specified, 
e.g. as “In a Civil Union”, “Divorced”, “Separated”, “In a relationship”, “It’s complicated”, 
“In a Domestic Partnership”, “Open relationship”, “Single”, “Engaged”, “Married”, 
“Widowed”, etc. in the case of the “Relationship” category. 

45 By using Custom Audiences, advertisers can target an audience which matches 
precise criteria. The customer data they upload to the Facebook server are matched 
with data collected on the social network to create their own target group, which 
consists of users identified as relevant to their campaigns. They can save their target 
group in the Ad Manager and use it for campaigns on Facebook.com, Instagram or the 
Facebook Audience Network. Facebook offers various types of Custom Audiences. 

46 A special Facebook interface (“Facebook Pixel”, see details under c. below) allows 
advertisers to use their list of customers as a basis for a Custom Audience. It shares 
the data with Facebook in encrypted form. The data contains different pieces of 
information on the target person (e.g. first and last name, phone number, e-mail 
address, town, country, date of birth, age, sex, Facebook ID or mobile advertising IDs 
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to identify smartphones, e.g. Android’s Advertising ID (AAID) or Google’s “Apple’s 
Advertising Identifier (IDFA).^"^ 

47 Custom Audiences can also be based on information about which users have visited 
the advertiser’s website^® or app^®, allowing them to address Facebook users who have 
visited the advertiser’s website in the last 30 days or who have viewed specific 
products. 

48 Another option is to build a Custom Audience based on data on Facebook users’ 
engagement with the advertiser’s content (“Engagement Custom Audiences”). 
“Engagement” refers to activities on Facebook.com like viewing a video or an 
advertisement. 

49 Advertisers can also create Lookalike Audiences with Facebook users who are 
“similar” to their customers and are thus potentially interested in their products.^® 
Lookalike Audiences are based on a “source audience”, which can consist of a list of 
existing customers, a Custom Audience of the advertiser, a list of users of a particular 
Facebook site or users having been determined as potential buyers on one of the 
advertiser’s websites.^® Facebook analyses the source audience with regard to 
commonalities between the members of the target group (personal aspects like age, 
employer, industry, region, etc. or online behaviour, response to advertising, etc.). 
Facebook then looks for users sharing these characteristics. These users are the 
“Lookalike Audience”, which is added to the advertiser’s target group and which can be 
further specified by applying the targeting options described above."^® 

c. Developer platform and Facebook Business Tools 

50 Under the umbrella of “Facebook Business Tools”, Facebook offers businesses a 
variety of tools and products to utilise the network’s reach and information as well as 
the access to Facebook users for various business purposes. Facebook claims that 
these products are meant to help businesses “integrate, use and exchange information 
with Facebook.””^^ The products address website owners, developers, advertisers and 
other companies, who can incorporate Facebook’s pre-defined Application 


https://www.facebook.com/business/help/570474483033581 ?helpref=paae content, f...] 

https://www.facebook.com/business/help/449542958510885/?helpref=hc fnav , [...1 

https://www.facebook.eom/business/help/1472206006327390/?helpref=hc fnav . [...] 

https://www.facebook.eom/business/help/1707329062853572/?helpref=hc fnav . [...] 

38 [...] 

33 https://www.facebook.com/business/learn/facebook-acls-lookalike-audiences1 f.. .1 

« [...] 

Facebook Business Tools Terms under https://www.facebook.com/legal/terms/businesstools [...] 
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Programming Interfaces (APIs) into their own websites, apps and online offers or offers 
on the Facebook platform via a configurator. Facebook does not charge a monetary 
fee for this service. 

51 Facebook describes various tools on the “Facebook for Developers” site: Currently 
these are “Account Kit“, “App Ads“, “App Links", “Audience Network" “Facebook 
Analytics", “Facebook Business SDK", “Facebook-Login", “Facebook Pixel", “Groups 
API", “Instagram Graph API", “Marketing Graph API", “Messenger Platform", “Pages 
API", “Places Graph" and “Workplace". The products “Audience Network”, “Instagram 
Graph API”, “Instant Articles”, and “Live Video API” are listed under “Publishing”. The 
tab Social Integrations lists the “Group Plugin”, “Instagram Graph API” again, “Sharing” 
and the subcategory “Social Plugins” with the tools “Group Plugin”, “Save”, “Like, 
Share, Send & Quote”, “Embedded content and video player”, “Page Plugin”, 
“Comments” and the “Messenger Plugin”. There is also a Gaming tab listing “Facebook 
Gameroom”, “Game Payment”, “Games on Facebook”, “Instant Games”, “PC Games 
SDK” and “Unity SDK”. The site also lists “AR Studio” (formerly “Camera Effects 
Platform” and the artificial intelligence service “wit.ai”). 

52 There are various applications of Facebook Business Tools. Essentially businesses 
can use the products to interact with Facebook users on the company website (outside 
Facebook.com) and initiate actions both on the social network and on their own 
websites or apps (especially social plugins, Facebook Login, Account Kit). Businesses 
can also use the products to develop and/or incorporate contents and apps on the 
Facebook platform or their own Facebook company pages (e.g. Pages API, Live Video 
API, Graph API, Games on Facebook). Facebook Business Tools also inform 
companies about different kinds of Facebook user behaviour with regard to the 
company (measurement and analysis tools like Facebook Analytics or Facebook Pixel). 

53 The products Facebook describes as individual tools overlap in some aspects and can, 
for example, be part of another tool. The APIs, SDKs, Pixel and Plugins described 
above are normally the technical basis for the products which are based on them, e.g. 
by linking the business website to Facebook and giving access to the Facebook 
platform. Facebook Analytics, for instance, requires Facebook Pixel, Facebook login 
requires Facebook SDK, Games on Facebook can be realised with Unity SDK or other 
tools, and the Facebook Payment API is available for games payments. 

54 For the present proceeding especially the tools linking Facebook.com with companies 
operating websites or apps outside of and independently from Facebook.com are 
relevant. Of the products described above, these are mostly the social plugins (see 
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(1) Facebook Login and Account Kit (see (2), Facebook Analytics and other 
measurement and analysis tools requiring Facebook Pixei or SDK (see 3). 

(1) Sociai piugins 

55 With incorporated social plugins companies allow users of their apps or websites to 
integrate and share their contents in the Facebook.com social network in various ways. 
Plugins serve to create buttons in a website or app which allow users different types of 
“social actions”. The following social plugins are available from the Facebook for 
Developers website: “Comments", “Embedded comments", “Embedded posts", 
“Embedded video player", “Group Plugin", “Like” button, “Page Plugin", “Quote Plugin", 
“Save" button, “Share” button. 

56 The best-known and most used plugin is the “Like” button. When activated on third- 
party websites or apps, the button connects the user’s “Like” of the site and displays 
the website or content in the Newsfeeds of his/her Facebook friends. 

57 The “Share” button is also a widely used plugin. Users can share content of websites 
or apps outside of Facebook.com with their Facebook friends and at the same time 
publish a status report containing a comment on that content. 

58 Many websites and some apps also contain Facebook’s “Page plugin”. With this plugin 
the publisher’s Facebook page can be incorporated into the company website in full or 
in part. Depending on the configuration, visitors can also use the Like and Share 
functions via this plugin and subscribe to (or “follow”) the company on Facebook via its 
website. 

59 The “Comment” plugin is also used on many websites and in some apps. Using their 
Facebook accounts including the profile picture users can discuss topics on the website 
and mark postings as “Liked”. The “Embedded comments” plugin serves to transfer 
comments made on Facebook.com regarding the website or app or its respective 
content to the website or app and display them there as well. Public posts can be 
transferred to and displayed on websites or apps with the “Embedded content” plugin. 
The “Embedded video player” serves to show Facebook videos on other websites or 
in apps. The “Quote” button is less significant. It can be used to share a text passage 
selected on a website on Facebook.com. The “Save” button lets users save articles or 
services on a private list on Facebook.com. They can also share it there and receive 
notifications. The “Group plugin” is a new feature allowing users to join a Facebook 
group via a link contained in an e-mail or on a website. 

60 From a technological point of view, social plugins can be implemented via coding 
interfaces for websites or apps. The essential tool required is a “Software Development 
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Kit” (SDK). An SDK is a collection of programming tools and libraries required for 
developing a software in a specific environment. Facebook provides various SDKs for 
download on its website. The “Facebook SDK” is intended for integrating social plugins 
into appsforthe mobile platforms iOS and Android. The “Facebook SDK for JavaScript” 
or so-called iFrames (inline frames) serve to incorporate social plugins on a website. 
An iFrame is an element of Hypertext Markup Language (HTML) which is used to 
structure websites with links, pictures and other content types. 

61 All interfaces support data flows from the user to Facebook.com, which do not depend 
on the actual activation of the plugin’s functionality by the users of the website or app 
(for details see para. 139ff.). 

(2) Facebook Login and Account Kit 

62 “Facebook Login” and “Account Kit” are widely-used tools supporting the login process 
on third-party websites and apps. 

63 Users identify themselves with their Facebook registration data (e-mail address or 
mobile phone number and Facebook password) on third-party websites with “Facebook 
Login”.'^^ They can also transfer personal data to the app to avoid having to create a 
new user profile when registering with a new app or website. 

64 Facebook Login is available for all standard platforms and operating systems: For iOS, 
Android, Web and Windows Phones, for desktop apps and for smart TVs, “Internet-of- 
Things” objects and similar devices. Users logging in via the Facebook Login can use 
the service on several devices and platforms as their user ID remains the same."^^ The 
“Account Kit” complements Facebook Login by enabling users to create a user profile 
on a third-party website or app simply by entering their phone numbers or e-mail 
addresses without having to enter a password.'^'^ This product is available to both 
registered and non-registered Facebook users.”^^ It can be used for the web and mobile 
iOS and Android platforms. 

65 From a technological point of view Facebook Login and Account Kit are implemented 
when the corresponding Facebook SDK is implemented, which can only be done with 
Facebook JavaScript SDK for websites. Again, the SDKs supply Facebook with 
information on which users create an account using which data on a third-party website 
even though the button was not actually used (see details in para. 143ff.). 


^2 [...] 

https://developers.facebook.com/docs/facebook-loain/overview/ , r...] 

[...] 

https://developers.facebook.com/docs/accountkit/overview/, f...] 
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(3) Analysis and measurement tools 

66 There are further Facebook Business Tools which primarily serve to analyse and 
measure the customers’ behaviour. These can be further categorised as tools for 
measuring the performance of a paid advertisement (see a) on the one hand or as 
Facebook Analytics for third-party websites and apps to analyse their sites or apps (see 
b) on the other hand. 

(a) Ads reporting 

67 Part of Facebook’s offer for advertisers in the area of online advertising is a variety of 
functions to measure the performance of their advertisements. The Ads Manager 
contains various reporting functions to create statistics and analyses on users’ 
interaction with Facebook advertisements (Ads Reporting).These functions allow 
advertisers to see, for example, how many people viewed their advertisement. They 
can also see details on the users’ demographics and the location where the 
advertisement was viewed, and they can adjust the settings accordingly (audience, 
placement, budget), or stop or rerun the advertisement."^^ 

68 The Ads Manager’s “Audience Insights” function shows advertisers detailed information 
on the audience they reached with their advertisements. The statistics contain 
demographic information (age, relationship status, sex, education, job, etc.), 
information on interests and lifestyle of the users, pages they “liked” and purchase 
information on their online shopping behaviour, location data etc. 

69 The reporting options go even further than just monitoring users while on 
Facebook.com. They can also comprise user “events” on third-party websites and 
apps, which can then be attributed to the advertisement under review. This information 
cannot flow unless Facebook Pixel has been installed on the websites or apps. 
Facebook Pixel is a tracking pixel, which is incorporated in a service as an often 
invisible graphic and loaded by the browser whenever the website is accessed. It is a 
snippet of JavaScript code that allows advertisers to track users’ opening the website 
and to collect other data. Advertisers can select from a pre-defined list of nine types of 
“events” and configure up to 100 further events themselves. Facebook tracks these 
events via the interface to third-party websites and apps and analyses them for the 


https://de-de.facebook.com/business/learn/facebook-ads-measurina-results, f...] 

https://de-de.facebook.com/business/iearn/facebook-ads-reportina-ads-manaaer . [...] 
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advertisers.'^® User activities within 28 days after clicking on an advertisement are 
normally attributed to the ad.'^® 

70 The “Attributions” tool also allows advertisers to measure the performance of their 
campaign across several channels and to compare several campaigns. “Facebook 
brand lift studies” help advertisers understand how well their brand campaign 
resonated with people and raise brand awareness.®® “Audience Insights” is a tool for 
businesses which have created Custom Audiences.®^ Audience Insights is a Facebook 
service providing companies with aggregated demographic and interest-based 
information on the Custom Audience.®^ “Sharing Insights” gives third-party providers of 
apps and websites an insight into how users share their content on Facebook.com. 
They receive (aggregated) statistics on the audiences (by sex, age, town, country) and 
how (by post or comment) and what with (content of the shared comments) they 
interacted with their content on Facebook.com. “Page Insights” is a free function for 
companies having a company page on Facebook.com. It provides an analysis of page 
usage. Facebook also cooperates with third-party providers like Nielsen to measure 
the users’ consumer behaviour on other channels like TV, search engines, etc.®® 

(b) Facebook Analytics 

71 Facebook Analytics is a free tool for operators of websites and apps enabling them to 
analyse their own online services and obtain aggregated statistics on their audience. 
Its use is subject to creating a Facebook account and a “Business Manager Account”. 
It is not necessary to have a Facebook Page to use the tool.®'^ The company does not 
have to run advertisements on Facebook to use Facebook Analytics. Technologically 
speaking, Facebook Pixel incorporates Facebook Analytics into websites while 
Facebook SDK incorporates the tool into apps.®® 

72 Facebook Analytics provides third-party companies with aggregated data on how users 
interact with their services across several devices, platforms and websites. The third- 
party company can track and optimise the entire “customer journey” on mobile devices, 
online and offline and in other channels.®® Facebook offers a large number of 
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56 


https://analvtics.facebook.com/ ) [...] 








22 


measurement tools, e.g. audiences or audience statistics and analyses of user 
behaviour (aggregated statistics, audiences grouped by sex, age, household income, 
language, town, country).Third-party companies can select the “channels” they wish 
to analyse (e.g. their website, their app, their Facebook Page, etc.) and specify the 
“events” they want to analyse. They can choose from a list of up to 1000 different 
events.^® Since February 2018 it has been possible to combine several sources (e.g. a 
website and an app) in an “Analytics Dashboard” to measure the company’s 
performance across various sources. 

73 “Facebook Analytics” is a free analysis tool which is used by more than [...] third-party 
companies worldwide each month.®® 

3. Instagram 

74 Instagram is a service for sharing photos and short video clips and is often referred to 
as a “photo network” or “photo blogging” service. It was founded by Kevin Systrom and 
Mike Krieger in 2010. Facebook bought the service in 2012 for 1 billion US dollars. The 
service has been growing continuously, reaching 1 billion monthly active users and 
more than 500 million daily active users in 2018®°, [...] of them in Germany.®^ The 
service is financed through advertising and available free of charge. While most users 
use it via a mobile app and mobile devices with an integrated camera, a simplified 
desktop version is also available. 

75 Private users have to register via the mobile app. To register, they have to enter an 
email address, a user name and, as an optional but recommended piece of information, 
a phone number. They can also upload a profile picture and enter further personal 
information under “About”. While they can link their profile to their Facebook account, 
there is no obligation to do so. 

76 Users create a contact list for using Instagram either by using their address books or 
lists of friends from Facebook.com or Twitter (via the Twitter API) or by looking for 
people they know on the network. Instagram also suggests potential users to “follow”. 
When following other users, users can see their photos and posts on the “Home” page, 
which displays content in an order generated by an algorithm in a central and constant 
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stream. There are filters available to alter pictures and users can comment on them 
using emoticons. 

77 They can use the Instagram camera to take pictures or record videos and edit them 
using filters, texts, drawings or special effects before sharing them with other users. In 
addition to that, they can add hashtags to pictures. The hashtag symbol (#) serves to 
mark key words to make sure messages labelled with certain contents or topics can be 
found. Instagram copied this functionality from Twitter, which introduced it as a 
characteristic of its service (see para. 203 below). Photos can also be marked with a 
location. 

78 Posts can either appear as “Stories” or as status reports on the “Home” page. In 
summer 2016 Instagram introduced the “Story” function which is similar to a function of 
the same name offered by “Snapchat” (see para. 196). Users can compile photos and 
videos in a “slideshow”, which is visible for 24 hours before it is deleted automatically. 
Figures published in the 2nd quarter of 2018 suggest that 400 million people worldwide 
use Instagram’s Story function.®^ Postings to the “Home” page are displayed 
permanently. 

79 Every user profile, and hence the postings it contains, are public by default on 
Instagram. Users can change this setting to “private”, making postings visible to 
approved subscribers only. The stories will then only be visible to users who subscribed 
to the profile. It is possible to explicitly exclude individual users from that circle. A chat 
function for direct communication with individual users is available too. 

80 There is also a search function for areas of interest (music, sports, style, humour, film 
and television, science, beauty), media and users. 

81 Further users of the service include companies and celebrities who can be followed by 
other users. Companies have to set up a business account to use the service. More 
than 25 million company profiles existed worldwide in July 2018.®^ Celebrity accounts 
are often used for marketing purposes (“Influencers”). 

82 Instagram is integrated into Facebook.corn’s Ad Manager. Companies wishing to 
advertise on Instagram must have both a Facebook page and an Instagram company 
profile. Advertisements can be placed in different formats on the Instagram feed or in 
Instagram Stories.®"^ 
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4. WhatsApp 

83 WhatsApp Inc. was founded by Jan Koum and Brian Acton in California/USA in 2009. 
Facebook bought the company for 19 billion US dollars in 2014. The company’s Irish 
subsidiary WhatsApp Ireland Ltd. provides the service to German users.®® More than 1 
billion people used the service worldwide in 2018, [...] of whom were in Germany.®® 
WhatsApp is a free service which was originally developed as a free internet-based 
alternative to short message services (SMS). WhatsApp is available as an app and as 
a desktop version. 

84 WhatsApp is an instant messaging service which uses a network protocol for data 
exchanges between computers. This protocol is proprietary (“XMPP”). To communicate 
with one another, users need the app and an internet connection. 

85 Users have to register with WhatsApp providing their own mobile phone number after 
installing the app. The registration of a WhatsApp account is concluded by verifying the 
mobile phone number with an access code that is sent via SMS. Users are asked to 
allow access to their contacts upon registration. WhatsApp then compares all the 
phone numbers from the contact list with the list of registered WhatsApp users to create 
the WhatsApp contact list. 

86 Using the service, users can send and receive a multitude of media like text messages, 
photos, videos, documents, locations, voice messages and voice calls.®^ Both group 
chats and bilateral messages are possible. WhatsApp emphasises that messages sent 
and calls made via its service are “end-to-end encrypted” for security reasons. The 
encryption was developed in cooperation with Open Whisper Systems to ensure that 
content is only available to the desired contacts.®® Since 2016 WhatsApp has been 
offering a “Status” function displaying status reports with photos, videos, emoticons, 
texts or drawings for all contacts, similar to the “Story” function. Figures published in 
the 2nd quarter of 2018 suggest that 450 million people worldwide use WhatsApp’s 
Status function.®® 

87 WhatsApp has not been monetised through advertising so far. In September 2017 
WhatsApp announced that it would develop functions in future which would make it 


65 [...] 

66 [...] 

6^ https://www.whatsapp.com/about/ , [...] 

66 https://www.whatsapp.com/securitv/ includes a link to a “Technical White Paper" explaining the technical details 
of encryption, [...] 

66 https://www.aiaa.de/unternehmen/whatsapp-inc/news/wtf-der-whatsapp-status-ist-ein-weltweiter-hit/ (in 

German, last accessed on 15 January 2019). 
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easier for businesses to communicate with private users/® The WhatsApp Business 
App was launched in early 2018/^ It offers additional functions like business profiles, 
away messages or the registration of landline phone numbers/^ While chats with 
customers are free of charge for businesses, they have to pay for real-time 
notifications/® WhatsApp Business provides businesses with aggregated statistics, 
e.g. on the number of messages sent, delivered or read/"^ Running ads in the 
WhatsApp will probably also be possible as of 2019/® 


II. Facebook’s Terms of Service and Data Policy 
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Use of the social network’s various areas and functionalities is subject to specific 
conditions which Facebook stipulates in comprehensive sets of conditions and policies. 
Upon registration, private and business users 
(advertisers, publishers, businesses, 
developers, etc.) have to agree to these 
conditions before they start using 

Facebook.com. 


Sign Up 

It’s free and always will be. 


Facebook's Terms of Service^® (see 1) are 
the starting point for all user groups and 
Facebook products. 




In addition, Facebook refers to the “Data 
Policy ”^^ (see 2.) and the “Cookies Policy ”^® 
(see 3.). Furthermore, the terms and 
conditions of other Facebook products are 
significant (see 4). 
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1. Facebook Terms of Service 

91 Facebook's terms of service generally apply to the use of all products, features, apps, 
services, technologies and software that Facebook defines as “Facebook Products” 
or “Products”. There are further terms of service that apply to specific areas and which 
are referred to in the Facebook Terms of Service. In some cases they are intended to 
complement the general Terms of Service and in others to replace them. These are the 
“Community Standards”^®, “Commercial Terms’’®®, “Ads Policy”®\ “Terms for Self-Serve 
Ads”®^, “Pages, Groups and Events Policy”®®, “Facebook Platform Policy”®'^, “Developer 
Payment Terms”®®, “Community Payment Terms”®®, “Commerce Policies”®^, “Facebook 
Brand Resources”®® and “Music Guidelines”®®. In addition, the “Facebook Business 
Tools Terms”, which are not mentioned in the Terms of Service, entered into force on 
25 May 2018.®° 

92 The term "Facebook Products” is explained in more detail via a hyperlink.®^ According 
to this information, “the Facebook Products include Facebook (including the Facebook 
mobile app and in-app browser), Messenger, Instagram (including apps like Direct and 
Boomerang), Portal-branded devices. Moments, Bonfire, Facebook Mentions, Spark 
AR Studio, Audience Network, and any other features, apps, technologies, software, 
products, or services offered by Facebook Inc. or Facebook Ireland Limited under our 
Data Policy. ” The Facebook Products also include Facebook Business Tools, which 
are tools used by website owners and publishers, app developers, business partners 
(including advertisers) and their customers to support business services and exchange 
information with Facebook, such as social plugins (like the "Like" or "Share" button) 
and our SDKs and APIs.^^ 

93 The Terms of Service define the range of services provided by Facebook in Paragraph 
1 “Our Services”. There is a headline for each service Facebook provides with 
examples for each of them. The following headlines are listed: We “Provide a 


httDs://www.facebook.com/communitvstandards/ , [...] 
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personalized experience for you”, “Connect you with people and organizations you care 
about”, “Empower you to express yourself and communicate about what matters to 
you”, “Help you discover content, products, and services that may interest you”, 
“Combat harmful conduct and protect and support our community”, “Use and develop 
advanced technologies to provide safe and functional services for everyone”, 
“Research ways to make our services better”, “Provide consistent and seamless 
experiences across the Facebook Company Products”, “Enable global access to our 
services”. 

94 The Terms of Service contain data processing regulations regarding the content users 
create and share (Paragraph 3.3.1.) and the use of the user name, profile picture and 
information about users’ actions with ads and sponsored contents (Paragraph 3.3.2.). 
In all other respects, Paragraph 2 of the Terms of Service indicates under the heading 
“Our Data Policy and your privacy choices”: “We collect and use your personal data in 
order to provide the services described above to you. You can learn about how we 
collect and use your data in our Data Policy [hyperlink]. We also encourage you to 
review the privacy choices [hyperlink] in your settings. They determine how we use 
data”. 

95 The Terms of Service also contain provisions regarding the general use of the social 
network, imposing certain obligations on users, for instance, to use the name they use 
in everyday life, provide accurate information on themselves, be at least 13 years old 
(Paragraph 3.1), or not to do or share anything that is unlawful (Paragraph 3.2). 

96 According to Paragraph 5, these terms make up the entire agreement between the 
users and Facebook Ireland Limited regarding the use of Facebook Products. The 
terms further state that if the user is a “consumer” and habitually resides in a Member 
State of the European Union, the laws of that Member State apply to any claim. 
Consumers may resolve their claims in any competent court in that Member State that 
has jurisdiction over the claim. In cases where the user is not a consumer, the claim 
must be resolved in a competent court in the Republic of Ireland and Irish law governs 
the terms. 

2. Data Policy 

97 The Data Policy is supposed to inform Facebook users about how their data are 
handled. It describes which kind of data (“information”) is “collected” by Facebook and 
how it is “processed” and “shared”. As for the Terms of Service, the Data Policy applies 
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to all Facebook Products unless stated otherwise. The Data Policy contains many 
hyperlinks to other documents.®^ 

98 The Data Policy provides an overview of the data Facebook collects under Paragraph 
I. Facebook collects all data associated with the use of any of the Facebook Products. 
Other than the information actively shared by the users, this also includes data 
automatically transmitted to Facebook by the browser or device while the network is 
used. It includes, for example, information on people, pages or groups the users are 
connected to or interact with (“Networks and connections”). The contact information the 
user uploads, synchronises or imports from a device is collected. Facebook collects 
information on which content users view and how they interact with this content or 
which transactions they carry out. 

99 Facebook indicates what information it collects on the computers, phones, connected 
TVs and other web-connected devices used if they integrate with Facebook Products 
under the headline “Device Information”. Facebook combines this information across 
the devices and services used by the user. This includes a large number of device 
attributes (operating system, hardware and software, browser type etc.), information 
about operations and activities performed on the device, identifiers (device IDs and 
other identifiers, such as from games, apps or accounts and Family Device IDs), device 
signals (Bluetooth, WLAN signals etc.) data from device settings (“information that you 
allow us to receive through device settings that you turn on, such as access to your 
GPS location, camera or photos etc.”), network and connections (“information such as 
the name of your mobile operator or ISP, IP address, mobile phone number”) and “data 
from cookies stored on your device, including cookie data that refers to Facebook and 
Instagram Cookies Policy”. 

100 Pursuant to the Data Policy, Facebook.com can also collect data on user activities off 
Facebook.com from advertisers, app developers and publishers (referred to as 
“partners”) who use Facebook Business Tools. Facebook states in its Data Policy that 
partners “provide information about your activities off Facebook—inciuding information 
about your device, websites you visit, purchases you make, the ads you see, and how 
you use their services—whether or not you have a Facebook account or are logged 
into Facebook”. Facebook also registers information on online and offline actions and 
purchases from third-party data providers. 

101 Under IV. Facebook explains how the “Facebook Companies” work together. It 
includes a hyperlink to further information on “Facebook Company Products”. It is 
explained that the Facebook Company Products are, together, the Facebook Products. 
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“They also include other products provided by the Facebook Companies that are 
subject to a separate, stand-aione terms of service and privacy poiicy, inciuding the 
WhatsApp, Ocuius, Masquerade, and CrowdTangie websites, products, or apps". 
Facebook says it also processes user data “across the Facebook Companies for these 
purposes, as permitted by appiicabie iaw and in accordance with their terms and 
poiicies". Facebook claims this is to “provide an innovative, reievant, consistent and 
safe experience" across all Facebook Company Products used. 

102 Paragraph II of the Data Policy indicates that Facebook uses the information as 
described in the following and “to provide and support the Facebook Products and 
rotated services described in the Facebook Terms and Instagram Terms". 

103 The information is used to “provide, personaiize and improve our products". Facebook 
explains that the information is used to personalise features and content and make 
suggestions for the user on and off the Facebook Products (e.g. groups or events users 
may be interested in or topics they may want to follow). Facebook states that it uses 
the connections, preferences, interests and activities to create personalised products 
that are unique and relevant to the users based on the data it collects on them and 
others including any data with special protections they choose to provide where they 
have given their explicit consent, how they use and interact with the Facebook 
Products, and the people, places or things they are connected to and interested in on 
and off the Facebook Products. 

104 To this end, it uses information across Facebook Products and devices in order to 
provide a more tailored and “consistent experience” on all Facebook Products used. 
Location-related information and face recognition are also used when activated. 
Facebook indicates that it uses the information for product research and development 
and to personalise ads. Users find additional information on the choices they can make 
in their private settings by clicking on a hyperlink. 

105 In their private settings, users have the option, in addition to the privacy settings relating 
to the use of the social network itself (e.g. settings as to who can see the users’ 
content), to change settings in their "Ad preferences" and to block certain targeted 
advertisements there.®'^ Users can choose not to use partner information - that is, 
information collected through Facebook Business Tools and third-party data providers 
- to personalise advertisements on Facebook.com. 

106 Facebook says it also uses information to “provide measurement, anaiytics and other 
business services”. Facebook says it uses the information it has (including users’ 
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activity off Facebook Products, such as the websites users visit and ads they see) to 
help advertisers and other partners measure the effectiveness and distribution of their 
ads and services, to understand the types of people who use their services and how 
people interact with their websites, apps and services. Facebook also says it uses 
information to promote safety, integrity and security, to send users marketing 
communications and also to research and innovate for social good. 

107 Facebook explains in Paragraph III how it “shares” its information with other people or 
businesses. In addition to sharing on Facebook Products, this also includes sharing 
with "third-party partners". The third-party partners also include partners who use 
Facebook analytics services. Facebook says it aggregates statistics and insights to 
show how people are engaging with their posts, listings, pages, videos and other 
content on and off Facebook Products. Information is also shared with advertisers who 
are provided with reports about the kinds of people seeing their ads and how their ads 
are performing. However, it does not share information such as names or e-mail 
addresses that identifies individuals. 

108 Facebook explains the following under Paragraph V. “What is our legal basis for 
processing data?": 

“We collect, use and share the data that we have In the ways described above: 

• as necessary to fulfil our Facebook Terms of Service or Instagram Terms of Use; 

• consistent with your consent, which you may revoke at any time through the 
Facebook settings and Instagram settings; 

• as necessary to comply with our legal obligations; 

• to protect your vital interests, or those of others; 

• as necessary in the public interest and 

• as necessary for our (or others') legitimate interests, including our interests in 
providing an innovative, personalised, safe and profitable service to our users 
and partners, unless those interests are overridden by your interests or 
fundamental rights and freedoms that require protection of personal data". 

109 A hyperlink (" Learn more ") takes the reader to another detailed document in which 
Facebook explains the legal bases.®^ For all people who have the legal capacity to 
enter into an enforceable contract, Facebook says it processes data “as necessary to 
perform our contracts with you”. Facebook describes the contractual services for which 
this data processing is necessary in "Our Services”. Consent is provided as a legal 
basis for processing data with special protections, the use of face recognition 
technology, the use of partner data and for personalised ads. Facebook asserts 
legitimate interests vis-a-vis people under the age of majority (under 18) - vis-a-vis all 
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users- for providing measurement, analytics and other business services, for marketing 
communications, to research and innovate for social good, to comply with legal 
obligations, to protect vital user interests, and to perform tasks carried out in the public 
interest. Last but not least, Facebook points out that when it processes users’ data as 
necessary for a task carried out in the public interest, users have the right to object to, 
and seek restriction of, its processing. 

3. Cookies policy 

110 The Cookies Policy®® complements the Data Policy and addresses the use of cookies 
and other storage technologies. 

111 The Cookies Policy defines cookies under the heading "Cookies and other storage 
technologies" as small pieces of text used to store information on web browsers. It says 
cookies are used to store and receive identifiers and other information on computers, 
phones and other devices. “Other technologies, including data we store on your web 
browser or device, identifiers associated with your device, and other software, are used 
for similar purposes. In this policy, we refer to all of these technologies as "cookies”. 

112 Facebook uses cookies if users have a Facebook account or visit websites and apps 
that use Facebook Products (including the “Like” button or other Facebook 
Technologies). Cookies enable Facebook to offer the Facebook Products to users and 
to understand the information it receives about them, including information about their 
use of other websites and apps, whether or not they are registered or logged in. 

113 Under the heading "Why do we use cookies”?, Facebook refers to authentication, 
security, advertising and measuring purposes and the improvement of Facebook 
services. 

114 Under the heading "Where Do We Use Cookies”? Facebook states that cookies may 
be placed on the users’ computer when they use the Facebook Products and the 
products provided by other members of the Facebook Companies and websites and 
apps provided by other companies that use the Facebook Products, including 
companies that incorporate the Facebook Technologies into their websites and apps. 
Facebook obtains device-related information and information about user activity on the 
third-party websites from websites and apps that use Facebook Products via the use 
of cookies without requiring any further action on the part of the user. This occurs 
whether or not the user has a Facebook account or is logged in.®^ 


https://www.facebook.com/policies/cookies/ version of 4 April 2018, [...] 
https://de-cle.facebook.com/policies/cookies/ , [...] 
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115 The Cookies policy also makes renewed reference to the above-mentioned “Ad 
Settings” under the heading “How can you control Facebook's use of cookies to show 
you ads”? that enable users to opt out of using partner information to personalise ads. 
Furthermore, the possibility of preventing interest-based online advertising from being 
displayed via the "European Interactive Digital Advertising Alliance"^® or via mobile 
phone settings is pointed out, as well as the possibility of relevant settings in the users' 
own browser. In doing so, Facebook indicates that certain parts of Facebook products 
may not function properly if browser cookies are disabled. 

4. Terms and conditions for other Facebook Products 

116 Facebook refers to further conditions for Facebook Products in the Facebook Terms of 
Service. These include in particular the terms and conditions that apply to the other 
Facebook-owned services WhatsApp, Instagram, Oculus and Masquerade (see a.). In 
addition, the conditions for the use of Facebook Business Tools are relevant (see b.). 

a. Facebook-owned services 

117 The Terms of Service of WhatsApp (see (1), Instagram (see (2) and the other retail 
services Oculus and Masquerade (see (3) are relevant to the subject matter of these 
abuse proceedings. 

(1) WhatsApp 

118 The Terms of Service, Privacy Policy and other cookie usage provisions'^ are similar 
to those of the Facebook.com service. The WhatsApp Terms of Service contain a 
comprehensive description of what the service offers under the heading "Our Services" 
as well as user obligations, limitations of liability, jurisdiction and arbitration agreements 
and other provisions. The Privacy Policy explains what information is collected, 
recorded, used, and shared and sets out the legal basis on which these procedures 
are based. 

119 As such, WhatsApp’s privacy policy points out that WhatsApp is one of the "Facebook 
Companies" and provides a hyperlink to the Facebook page for a definition of the term. 
It subsequently says: 

“As part of the Facebook Companies, WhatsApp receives information from, and shares 
information with, the Facebook Companies. We may use the information we receive from 
them, and they may use the information we share with them, to help operate, provide. 


http://www.vouronlinechoices.eu/ , [...] 

The fuii text is avaiiabie at https://www.whatsapp.eom/ieaai/#terms-of-service , in the version of 24 Aprii 2018, 
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improve, understand, customize, support, and market our Services and their offerings. 
This inciudes heiping improve infrastructure and deiivery systems, understanding how 
our Services or theirs are used, heiping us provide a way for you to connect with 
businesses, and securing systems. We aiso share information to fight spam, threats, 
abuse, or infringement activities and promote safety and security across the Facebook 
Company Products. However, your WhatsApp messages wiii not be shared onto 
Facebook for others to see. In fact, Facebook will not use your WhatsApp messages for 
any purpose other than to assist us in operating and providing our Services”. 

120 A hyperlink ( Learn more) takes users to the WhatsApp "FAQ" page, where WhatsApp 
explains: 

“Today, Facebook does not use your WhatsApp account information to improve your 
Facebook product experiences or provide you more relevant Facebook ad experiences 
on Facebook”. 

121 If users scroll down, they find the information: 

“Today, Facebook does not use your WhatsApp account information to improve your 
Facebook product experiences or provide you more relevant Facebook ad experiences 
on Facebook”. This is a result of discussions with the Irish Data Protection Commissioner 
and other Data Protection Authorities in Europe. We're always working on new ways to 
improve how you experience WhatsApp and the other Facebook Company Products you 
use. Should we choose to share such data with the Facebook Companies for this 
purpose in the future, we will only do so when we reach an understanding with the Irish 
Data Protection Commissioner on a future mechanism to enable such use”. 

122 If users scroll down a bit further, they are advised that: 

“WhatsApp currently shares limited categories of information with the Facebook 
Companies. This consists of the phone number you verified when you signed up for 
WhatsApp, some of your device information (your device identifier, operating system 
version, app version, platform information, your mobile country code and network code, 
and flags to enable tracking of the update acceptance and control choices), and some of 
your usage information (when you last used WhatsApp, and the date you first registered 
your account, and the types and frequency of your features usage)”. 

123 If users scroll down further, they will find the information: 

“Importantly, WhatsApp does not share your WhatsApp contacts with Facebook or any 
other members of the Facebook Companies, and there are no plans to do so. WhatsApp 
also does not share your messages with Facebook. In addition, WhatsApp cannot read 
your messages because they are end-to-end encrypted by default when you and the 
people you message with use the latest version of our app. Only the people you message 
with can read your messages - not WhatsApp, Facebook, or anyone else”. 

124 The data collected and stored by WhatsApp is assigned to Facebook user accounts 
via the so-called Family Device ID, which is installed on whatever mobile device users 


https://faa.whatsapp.eom/aeneral/26000112/?eea=1&lana=en , [...] 

https://faa.whatsapp.eom/aeneral/26000112/?eea=1&lana=en , [...] 

https://faa.whatsapp.eom/aeneral/26000112/?eea=1&lana=en , [...] 







34 


are using^°^. This is a unique identifier for each user, which is also installed when using 
Facebook and which identifies the user when data are matched. 

(2) Instag ram 

125 Instagram’s Terms of Use, Data Policy and Cookies Policy are very similar to those of 
Facebook and have been tailored to Instagram's specific services and offerings. Many 
of the hyperlinks to the definition of terms in the documents take users to the relevant 
Facebook pages. They include explanations of the legal bases on which Instagram 
relies for data processing. 

126 Instagram's privacy policy is identical to Facebook's.^®'^ This means the same amount 
of information on Instagram users is collected and used. Accordingly, the wording of 
Instagram's Privacy Policy in Paragraph IV “How do the Facebook Companies work 
together”? contains the same wording as the Facebook Privacy Policy that Facebook 
and Instagram share infrastructure, systems and technology with other Facebook 
Companies (which include WhatsApp and Oculus), “to provide an innovative, reievant, 
consistent and safe experience across aii Facebook Company Products”. It says “We 
also process information about you across the Facebook Companies for these 
purposes as permitted by applicable law and pursuant to their terms and policies’V°^ 

127 The data collected and stored by Instagram, as well as the WhatsApp data, can be 
assigned to Facebook user accounts because a Family Device ID is installed on the 
users' device. Unlike WhatsApp, the Privacy Policy does not include a restriction to 
certain information that is actually assigned to and combined with Facebook user 
accounts. In these legal proceedings, Facebook indicated in relation to Instagram's 
actual data processing before the service was transferred to Facebook Ireland Ltd. that 
the data collected in any event includes the users’ contact details (mobile phone 
number, e-mail address), data about the content generated by the user on Instagram 
and data about the users' Instagram via the users’ “contact graph", for instance about 
the persons whom the user ''follows'' on Instagram".This includes "log file 
information", (IP address, browser type, referring pages/exit pages and URLs, the 
number of clicks, interactions with the Service's links as well as domain name, landing 
page, viewed pages, information from e-mails sent to Instagram users), device IDs, 


[...] 

https://www.facebook.com/policies/cookies/ version of 19 February 2018, [...] 

https://heip.instaqram.com/519522125107875?heipref=paqe content under Paragraph IV. “How the Facebook 
Companies work together”, [...] 
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metadata (e.g. hash tags, geotags), and data about usage behaviour through cookies 
used. 

(3) Oculus and Masquerade 

128 The Facebook-owned services Oculus and Masquerade also indicate in their Terms of 
Service and Data Policy that they share data with Facebook. 

129 Oculus has strongly aligned its Terms of Use and Privacy Policy with Facebook. The 
wording under the heading “How the Facebook Companies work together” is identical 
to the wording of Facebook’s Data policy^°^, that Oculus shares infrastructure, systems 
and technology with other Facebook Companies (which include Facebook, Instagram, 
and WhatsApp), to provide users with an innovative, relevant, consistent and safe 
experience across all Facebook Company Products. For these purposes, Oculus 
processes information about users and their devices across Facebook Companies as 
far as permitted by applicable law and its Terms of Service and policies. 

130 When using Oculus, Facebook Technologies Ltd. collects data provided by Oculus 
users, pursuant to the Privacy Policy, and automatically collects data on user behaviour 
with all Oculus offerings and services, as well as device-related information, device IDs, 
location-related information, physical movements and dimensions (when using an XR 
device), photos and audio content when accessed with permission, information from 
cookies, pixels, and more.^°® 

131 Assignment to Facebook user accounts is made, according to Facebook - if the user 
uses a Facebook login - via the login, otherwise via the users’ e-mail address (which 
users have to provide when they sign up with Oculus). 

132 MSQRD/Masquerade's Privacy Policy is posted directly on a Facebook page and 
explains from the outset: 

“Depending on which services you use, we share information within the famity of retated 
companies that are iegaity part of the same group of companies that MSQRD is part 
of, or that become part of that group, such as Facebook. For a iist of our retated 
companies, piease see: “Facebook and the other companies in the Facebook famiiy 
may use information from us to improve your experiences within their services such as 
making product suggestions (for exampte, of friends or connections, or of interesting 
content), and to show reievant offers and ads”. 

133 Data collected by Masquerade includes information that users provide when they 
create an account and content users create or provide through the app, including 


cf. Data policy at httDs://www.oculus.com/leaal/privacv-policv/ in the version of 4 September 2018, [...] 
https://www.oculus.com/leqal/privacv-policv/ version of 4 September 2018, [...] 

109 [...] 





36 


photos, videos or masks. Masquerade also collects information that is part of the things 
users share, such as the location of a photo or the date on which a file was created. In 
addition, it also collects data such as payment information (debit or credit card 
information in relation to transactions), use of third-party websites or apps that integrate 
Masquerade and device-related information.^^® 

134 Assignment takes place according to the information provided by Facebook - if the user 
uses a Facebook login - via the login, or via a device ID.^^^ 


b. Facebook Business Tools 

135 Since 25 May 2018, Facebook Business Tools have been subject to separate Terms 
of Service, which apply to website operators and website owners, developers, 
advertisers, business partners (and their customers) and other persons. The Facebook 
Terms of Service do not contain any explicit reference to these terms of use. 


(1) Provisions set forth in the Terms of Service 

136 The term Facebook Business Tools is defined comprehensively in the Terms of Service 
and includes 

“APIs and SDKs, the Facebook pixel, social plugins such as the “Like” and “Share” 
buttons, Facebook Login and Account Kit, as well as other platform integrations, plugins, 
codes, specifications, documentation, technology and services". 

137 Paragraph 1 of Facebook Business Tools Terms says that Facebook Business Tools 
can be used to send personal data to Facebook about customers and users ("Customer 
Data"). Depending on the Facebook Products used. Customer Data may include: 

a. "Contact Information” consists of information that personally identifies 
individuals, such as names, email addresses and phone numbers that we use for 
matching purposes only. We will hash Contact Information that you send to us via 
a Facebook JavaScript pixel for matching purposes prior to transmission. When 
using a Facebook image pixel or other Facebook Business Tools, you or your 
service provider must hash Contact Information in a manner specified by us 
before transmission. 

b. "Event Data" includes other information that you share about your customers and 
the actions that they take on your websites and apps or in your shops, such as 
visits to your sites, installations of your apps and purchases of your products. 

138 Paragraph 2. of Facebook Business Tools Terms regulates the use of customer data: 


https://www.facebook.com/msqrd/privacv version of 28 June 2018, [...] 
[...] 
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"a. We will use Customer Data for the following purposes depending on which 
Facebook Company Products you choose to use: 

i. Contact information for matching 

1. You instruct us to process the Contact Information solely to match the Contact 
Information against Facebook's or Instagram's user IDs ("Matched user IDs”), as well 
as to combine those user IDs with corresponding Event Data. We will delete Contact 
Information following the matching process. 

a. Event Data for measurement and analytics services 

2. You instruct us to process Event Data: (a) to prepare reports on your behalf on the 
impact of your advertising campaigns and other online content ("Campaign Reports") 
and (b) to generate analytics and insights about your customers and their use of your 
apps, websites, products and services ("Analytics"). 

3. We grant to you a non-exclusive and non-transferable licence to use the Campaign 
Reports and Analytics for your internal business purposes only and solely on an 
aggregated and anonymous basis for measurement purposes. You will not disclose the 
Campaign Reports or Analytics, or any portion thereof, to any third party, unless 
otherwise agreed to in writing by us. We will not disclose the Campaign Reports or 
Analytics, or any portion thereof, to any third party without your permission, unless (i) 
they have been combined with Campaigns Reports and Analytics from numerous other 
third parties and (ii) your identifying information is removed from the combined 
Campaign Reports and Analytics. (...)” 

(2) Data collected 

139 The integration of Facebook Business Tools gives Facebook a direct connection to the 
website or app so that user data goes directly to the Facebook server when the website 
or app is called up or used, even when the person visiting the website or using the app 
does not activate the interfaces. 

140 Social plugins are integrated into websites via Java Script SDK or 1-Frame.^This 
means that the moment users load the web page in their browser, an HTTP request is 
automatically generated"^ and sent to Facebook. With every integrated interface, the 
IP address, the browser type, the URL of the visited website and the time of the visit 
are transmitted to the Facebook servers as a minimum data record when the page is 
accessed via a standard Internet protocol. If Facebook has additionally placed cookies 
on the user’s browser, the browser transmits additional data to the Facebook server.^^'* 


112 [...] 

112 HTTP is the communication protocol in the World Wide Web (WWW). The most Important functions are to 
request files from the web server and to load them Into the browser. The browser then displays texts and Images 
and takes care of the display of audio and video data. Communioation takes place according to the ellent-server 
principle. The HTTP client (browser) sends its request (HTTP request) to the HTTP server (Web server). This 
processes the request and returns its response (HTTP response). After the server has sent a response, this 
connection is terminated. Typically, several HTTP connections take place simultaneously; cf. 
httpsV/www.elektronlk- komDendlum.de/sltes/net/0902231 .htm (last accessed on 8 January 2019). 

11“* [...] See also https://developers.facebook.com/docs/pluqlns/faas (last accessed on 11 January 2019,[...]): 
‘What information does Facebook get when t impiement a Social Plugin and how is it used?: If a person has 
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This includes data such as the URL of the website that the user visited prior to the 
relevant website or the transmission of a "unique identification number", via which 
Facebook users can automatically be assigned to their Facebook user account.^^^ 

141 Social plugins are integrated into apps via the Facebook Sharing SDK. Via the SDK, 
Facebook receives information such as the Facebook App ID (an ID that Facebook 
assigns to the mobile app) and metadata of the device used. This includes, inter alia, 
the operating system used, device model, vendor, screen size, processor cores, total 
storage space, free storage space, name and version of the app used, the http header 
record and IP address as well as the time zone.^^® 

142 In addition, the SDK logs and captures certain "Events" in the Facebook Analytics app. 
Facebook makes a distinction here between “Automatically Logged Events”, “Implicit 
Events” and “Explicit Events”. “Automatically Logged Events" include basic user 
interactions in the app such as app installation or app starts, and system events such 
as SDK loading or SDK performance. This data is automatically sent to Facebook 
unless the app operator has explicitly disabled it.^^^ If the app operator uses the 
integration, such as the "Like" button, further data, the so-called “Implicit Events” are 
sent to Facebook. In addition to these preset events, the app operator can also 
configure additional app "Event" types, so-called “Explicit Events”.Here, app 
operators can choose from a wide range of event types: These events can be data 
about an app being launched, payment data being added, a level being reached, goods 
being placed in the shopping cart or added to a wish list, a registration or tutorial being 
completed, a purchase being started or completed, a rating being given, a product 
being searched for, credits being issued, a success being achieved or a content being 
displayed.App operators can track actions within their apps by selecting such events 
to receive the corresponding analysis data. 

143 By integrating the Facebook Login or Facebook Account Kit, Facebook receives 
information from third-party websites and apps about which websites/apps a Facebook 


visited Facebook and visits your website with a social plugin, the browser sends us information in order to load 
Facebook content on that page. The data we receive may include info like the person's user ID, the website 
they're visiting, the date and time, and other browser-related information. 1/1/e record some of this info and may 
use it to improve our products and services and to show people more interesting and useful ads", [...] 

[...] 

FAQs on the GDPR “What data does Facebook collect via the SDK?“, available at 
https://www.facebook.eom/business/m/one-sheeters/adDr-developer-faas , [...] 

FAQs on the GDPR, “What data does Facebook collect via the SDK?“, available at 

https://www.facebook.eom/business/m/one-sheeters/adpr-developer-faas, [...] 

FAQs on the GDPR “What data does Facebook collect via the SDK?“, available at 

https://www.facebook.eom/business/m/one-sheeters/adpr-developer-faas, [...] 

httDs://developers.facebook.com/docs/app-events/android (using Android devices as an example, similar to 
other operating systems, [...] 
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user registers with and how the user uses each website/app. The amount of data that 
Facebook currently receives is basically the same as the data record that can be 
captured with social plugins, since the Facebook Login is also implemented via the 
SDK. In addition, further data is collected. This includes "Error Information", which 
includes the user IDs of people logged into Facebook. According to Facebook, the 
company also receives the login information which users enter directly and manually - 
without using the Facebook Login - on the website of the provider who has the 
Facebook Login embedded. 

144 Measurement and analytics tools are on the one hand the SDK, which produces the 
data flows shown above. The "Facebook pixel" is the relevant interface that can be 
integrated into websites for this very purpose. The pixel is initially used to send the data 
record of the http header collected during the integration of each interface to Facebook. 
When the website is accessed, a standard web protocol is created by default that 
includes IP addresses, information about the web browser, page location, document, 
referrer (the web page from which the user has accessed the current website), and the 
person using the website. Via the pixel, Facebook receives pixel-specific data, 
including the pixel ID and the Facebook cookie. Facebook also receives "click data" for 
buttons ("button-click data") by default, namely any buttons clicked by site visitors, the 
labels of those buttons and any pages visited as a result of the button clicks. 

145 In addition, the website operator can configure certain user actions ("Events") regarding 
the use of the third-party website or app. In this case, Facebook receives additional 
information about user behaviour on Facebook.^^^ The pre-configured fifteen "Standard 
Events" include information about a purchase made on the website, a registration, the 
placing of goods in the shopping cart or a search query made by the user.^^^ Depending 
on the website operator's wishes, further "event types" can be configured in addition to 
these standard events, for instance information on whether the user has scrolled down 
to the end of a page or how many articles have been read in a session. 

(3) Assignment to the individual Facebook user accounts 

146 The collected data is assigned to the Facebook accounts of the relevant users. There 
are a number of ways in which the data collected can be assigned. 


120 [...] 

121 httDs://de-de.facebook.com/business/learn/facebook-create-ad-app-install-enaaaement , [...] 

122 [...] 

123 https://de-de.facebook.cpm/business/help/402791146561655?helpref=faa content : Standard-Events: Add to 
cart, Add Payment Infer, Add To Wishlist, Complete Registration, Contact, Customize Product, Donate, Find 
Location, Initiate Checkout, Lead, Purchase, Schedule, Search, Start Trial, Submit Application. 

12“* https://developers.facebook.com/docs/facebook-pixel/advanced , f...1 
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147 In the case of websites, the cookies stored on the users' browser in particular allow 
the observed user behaviour to be assigned to the individual Facebook user account. 
Facebook sets cookies on the browser of all Internet users when they visit a Facebook 
domain (such as www.facebook.de) for the first time.^^® If the user subsequently 
accesses a third-party website, the user browser also establishes a connection to 
Facebook and Facebook can read the cookie in the user's browser. If Facebook 
cookies are stored on the user’s browser, the user’s browser transmits additional 
information to Facebook - depending on what kind of cookies have been stored.In 
order to enable the data collected, for instance Facebook pixels to be assigned to 
Facebook user accounts, Facebook transmits the "pixel ID" via a Facebook cookie. 

If the cookie is not already present on the browser, it is set at the time the website is 
accessed. 

148 If cookies cannot be stored in the user's browser - e.g. due to relevant user settings - 
there is the possibility of "Advanced Matching” through the use of "identifiers" in order 
to assign user behaviour to Facebook user accounts. This is where the third-party 
company has the option of sending its own customer lists, so-called "custom identifiers" 
to Facebook. The customer list is encrypted locally on the user's browser by means of 
"hashing" and is then transmitted to Facebook. The data is hashed before it is 
transmitted. A so-called "hash value" is assigned to the data with a certain algorithm, 
ensuring the data is no longer recognisable in plain text during transmission. According 
to Facebook, the data is matched with Facebook users, with the hashed value being 
assigned to the individuals. This is possible because data records that have been 
hashed using the same algorithm or the same hash function also have the same identity 
hash value. Facebook then matches the transmitted data and adds the "matched" data 
to the advertiser's custom audience.According to Facebook, all hashes sent are 
deleted, unless Facebook needs the data for fault clearance or product improvement 
purposes.Facebook claims, however, that these data records are not used to 
permanently update Facebook user data.^^^ 

149 Cookies are no longer used for mobile apps; Facebook identifies the user via the SDK 
reading the advertising ID of the operating system on the terminal (Identifier for 


125 [...] 

126 Facebook provides an overview of cookies via a hyperiink in its Cookies Poiicy. 

127 [...] 

128 [...] 

129 https://www.facebook.eom/business/heip/112061095610075?heipref=faq_content, [...] 

130 [...] 

131 [...] 
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Advertising ("IDFA") for iOS or Android Advertising ID ("AAID") for Android). It is 
therefore possible to identify users without having to use an additional cookie. 

150 Facebook also uses other metadata, in particular various device-related data, to assign 
the data to a Facebook user.^^^ 


III. Progress of the proceedings 

151 The Bundeskartellamt instituted proceedings in a letter addressed to Facebook Inc., 
Facebook Ireland and Facebook Germany on 1 March 201As part of the 
investigations, the Decision Division sent decisions requesting information to 
Facebook^^® and companies potentially competing with Facebook^^®. On 14 July 
2016^®^, the Federation of German Consumer Organisations (Verbraucherverband 
Bundeszentrale, VZBV) was invited to join the proceedings upon their application filed 
on 13 June 2016^®®. From 19 to 28 October 2016, the market research company 
Marplan/Forsa conducted a consumer survey on the use of social media among a total 
of 1,117 consumers on behalf of the Bundeskartellamt.^®® The Bundeskartellamt 
granted the parties to the proceedings access to the file on the results of the survey.^'^® 

152 The Bundeskartellamt carried out further investigations between December 2016 and 
February 2017 by issuing decisions requesting information from media agencies^"*^ and 
advertisers.^'^® In a letter dated 22 May 2017^^^® and an e-mail dated 28 July 2017^"^^^, 
the Bundeskartellamt asked Facebook further questions about its advertising activities 
and data processing practices. 
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153 The Bundeskartellamt held talks with Facebook and its legal representatives on 21 
March 2016^^5^ 12 May 2016^^6^ 25 January 2017^^^ 5 April 2017^^8^ 14 July 2017^^^ 
and 7 November 2017^^°. In addition, it held talks with the Federation of German 
Consumer Organisations^^^ on 22 April 2016 and on 12 May 2017 and with Hamburg’s 
Commissioner for Data Protection and Freedom of Information on 5 May 2017^^^. It 
also held talks with representatives of media agencies^^^ and representatives of Google 
Inc. 

154 Facebook submitted a White Paper on “Relevant Markets and Lack of Dominance’’^®'^ 
on 18 November 2016 in which it essentially states that Facebook does not have the 
characteristics of a norm addressee. It is assumed the relevant market for the product 
concerned is a "market for attention" on which countless competitors compete for the 
attention of users on the Internet in addition to Facebook. Even if one were to assume 
there is a market for social networks, which is not the case, it would at least include the 
competitors Instagram, YouTube, Google+, Twitter, Snapchat, Pinterest, Linkedin, 
Xing and StudiVZ and would be defined as a global market. The White Paper says 
Facebook is not dominant in the market given that competitors exert considerable 
competitive pressure on Facebook through technical innovations. It says switching 
costs are low and users practice multi-homing on a large scale and there are still no 
significant barriers to market entry. 

155 In a written observation dated 5 May 2017, Facebook reiterated its view that Snapchat 
and YouTube should be considered to be part of the relevant product market. In 
addition, it called the validity of the user survey commissioned by the Bundeskartellamt 
into question.^®® 

156 In a letter dated 16 October 2017^^® Facebook commented on the theory of harm put 
forward by the Bundeskartellamt. It says this contravenes European data protection 
law, as it imposes a higher data protection standard on Facebook as the market leader 
than on other market players. Also, since the 9th Amendment to the German 
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Competition Act (Gesetz gegen Wettbewerbsbeschrankungen (GWB)) entered into 
force, the Bundeskartellamt had only been responsible for sector inquiries in the area 
of consumer protection, but not for enforcement of any other consumer law provisions. 
It claims the Bundeskartellamt was circumventing the statutory requirements for a 
comparative market analysis pursuant to Section 19 (2) no. 2 GWB if it bases abusive 
terms on the general clause of Section 19 (1) GWB. It says there was no causality 
between the alleged abusive conduct by Facebook and a dominant position in the 
market, as numerous other companies behaved in a similar way when handling 
personal data. And finally, it says the Bundeskartellamt has disregarded an effect- 
based approach. In this context, Facebook submitted an economic expertise by Prof. 
Dr. Haucap (DICE Consult GmbH). This argues that the combination of "on-Facebook 
data" and "off-Facebook data" is efficient as it improves both the product itself and the 
quality of targeted advertising. Furthermore, it says that intervention by the cartel 
authority strengthened the market structures, as users would have no reason to switch 
to a competitor if the dominant company behaved in a data protection-friendly manner. 

157 In a letter dated 19 December 2017 (“preliminary assessment notice”)^®^, the 
Bundeskartellamt informed Facebook that based on its current assessment, it intended 
to prohibit Facebook from making the personal use of the social network Facebook.com 
in its Terms of Service contingent on Facebook being able to amass any type of user 
information from Facebook-owned services and programming interfaces, to assign this 
data to Facebook user accounts, and to use it for any purpose with any data processing 
procedures mentioned in Facebook's Privacy Policy. The Bundeskartellamt gave 
Facebook the opportunity in the preliminary assessment notice to submit justifications 
for the data collection and assignment provided for in its Terms of Service. 

158 Facebook responded to the preliminary assessment notice issued by the 
Bundeskartellamt in a letter dated 19 April 2018^^®. It says Facebook is not dominant 
in the market since the Bundeskartellamt had defined the market incorrectly. 
Furthermore, Facebook claims it did not have a dominant position in the market 
because it faced high innovation-driven competitive pressure and the Bundeskartellamt 
had incorrectly analysed the implications of network effects. It also says Facebook did 
not engage in abusive practices, adding that the Bundeskartellamt did not prove the 
conditions necessary for an abuse, in particular it did not take the conduct of 
undertakings in comparable markets into account pursuant to Section 19 (2) no. 2 
GWB, nor did it sufficiently prove the causality between abusive conduct and the 
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Group’s market position. As a result, Facebook claims the Bundeskartellamt, as the 
competition authority, was enforcing data protection law for which it had no substantive 
competence. In addition, the letter says that Facebook was acting pursuant to German 
and European data protection law since users had given their effective consent and 
Facebook’s data processing was necessary for performance of the contract and was 
justified by overriding interests. Facebook submitted an economic analysis carried out 
by David S. Evans on the subject “Economic Analysis of Exploitative Abuse involving 
Attention Platforms and the Implications for Facebook‘s Use of Data” on 22 May 
2018 .^ 5 ® 

159 In the spring of 2018, the Bundeskartellamt conducted further investigations, issuing 
decisions requesting information from Facebook^®® and companies potentially 
competing with Facebook^®^ It engaged in further discussions with Facebook's 
competitors and with companies in the advertising, publishing and online retail 
industries. Members of the case team have talked to representatives of the VZBV^®® on 
5 March 2018, representatives of the Hamburg data protection commissioner on 23 
April 2018, representatives of the Federal data protection commissioner on 5 June 
2018 as well as representatives of the IDPC on 29 November 2018^®“^. 

160 In a written statement dated 1 June 2018, Facebook announced the development of a 
new "clear history" function that was currently in the pipeline [...].^®® 

161 In a written observation dated 17 October 2018^®®, Facebook submitted a commitment 
proposal [...]. 

162 On 5 November 2018, the Bundeskartellamt once again informed Facebook of its 
antitrust concerns in a statement of objections and granted Facebook access to files. 
Facebook responded to the statement of objections in a letter dated 11 January 2019, 
elaborating on its previous submission and commenting on the suspension of 
immediate enforcement pursuant to Section 65 (3) sentence 1 no. 3, sentence 2 
GWB.^®^ The Federation of German Consumer Organisations^®®, Hamburg’s 
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Commissioner for Data Protection and Freedom of Information^®® and the Federal 
Commissioner for Data Protection and Freedom of Information^^® have also responded 
to the statement of objections. 
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B. Legal assessment 

163 The use and implementation of the terms of service which are specified in the data and 
cookies policies or comparable contractual documents, as described in detail in the 
operative part, constitutes an abuse of a dominant position on the market for social 
networks for private users in the form of imposing abusive business terms pursuant to 
the general clause of Section 19(1) GWB. 

164 Facebook is the addressee of Section 19(1) GWB for private users on the national 
market for social networks due to its dominant market position within the meaning of 
Section 18 GWB (see I.). The data processing conditions specified in the operative part 
constitute abusive terms within the meaning of the general clause of Section 19(1) 
GWB as far as data processing by the corporate services WhatsApp, Oculus, 
Masquerade and Instagram as well as Facebook Business Tools are concerned. These 
services are offered as services separate from Facebook.com (see II.). This section 
applies irrespective of whether the conduct also constitutes an abuse pursuant to Art. 
102 TFEU (see III.). 

I. Addressee of the provisions 

165 On the national social network market for private users, Facebook is the dominant 
undertaking within the meaning of Section 18(1) in conjunction with Section 18(3a) and 
(3) GWB. It can be left open whether market dominance has to be assumed for other 
affected markets. 

1. Markets concerned 

166 In the broadest sense, the conduct affects the competitive environment of social media 
(see a.). The national social network market for private users is affected as a separate 
market in the context of social media markets (see b.). Generally speaking, the market 
for online advertising which is not linked to search queries (see c.) is also affected; 
however, the exact market definition can be left open. The service also has further 
market sides which can be attributed to various separate markets, which especially 
applies to the user sides of the so-called developers (see d.). Again, the exact market 
definition can be left open in this case. 

a. Social media in Germany 

167 With its services Facebook.com, Facebook Messenger, Instagram and WhatsApp, 
Facebook operates in the area of “social media” in the broadest sense. The competitive 
environment attributed to "social media" typically comprises various services (see (1). 
For these proceedings, the Bundeskartellamt’s Decision Division will consider the 
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company-owned services Facebook.com, Facebook Messenger, Instagram and 
WhatsApp and approx. 30 other services for the market definition (see (2), taking into 
account a user survey which was previously conducted. 

(1) Relevant competitive environment 

168 The terms “social media” and “social networks” are vague and the details of the various 
definitions of these terms vary considerably. Basically, the term “social media” refers to 
all media used by internet users for the purpose of communication, with interactivity 
playing a key role. An uncountable multitude of services is often summarised by this 
term. Facebook itself states [...] as its competitors. 

169 According to a definition by the German Association for the Digital Economy 
(Bundesverband Digitale Wirtschaft, bvdw)^^^, social media are “a multitude of digital 
media and technologies enabling users to exchange information between themselves 
and to design media contents either individually or as a community. The interactions 
include mutual exchanges of information, opinions, impressions and experiences, and 
the participation in content creation. Users actively refer to contents through comments, 
ratings and recommendations. In doing so, they establish a social connection to each 
other. (...)“.^^^ Another definition reads as follows: “Social media are internet platforms 
on which users can build relationships with other users and communicate. 
Communication does not merely comprise the exchange of verbal messages, but also 
involves many multimedia formats like photos, videos, music and speech recordings 
and games. The user community of such a social media platform is referred to as a 
“community”. (Bundeskartellamt unofficial translation) 

170 In the public discussion, the various forms of social media are classified according to 
various criteria. From a marketing perspective, for instance, “social networks” (e.g. 
Facebook, Linkedin, Xing, WhatsApp and dating portals) are differentiated from 
“content sharing & entertainment platforms” (e.g. YouTube, FlickR, Instagram, 
Pinterest), “knowledge communities” or “blogging platforms” (e.g. Twitter, which is often 
classified as a “microblog”), and “consumer communities (e.g. rating portals).Other 
marketing representatives, however, distinguish “social networking” from “social 
sharing”. According to them, social networking is offered by services linking people with 


[...] 

172 Bundesverband digitale Wirtschaft, www.bvdw.ora (last accessed on 8 January 2019). 

173 "Social Media Kompass 2017/2018“ of the BVDW, 

https://www.bvdw.orq/fileadmin/bvdw/upload/publikationen/social media/kompass social media 2017 2018. 

pdf , (last accessed on 8 January 2019), see glossary on page 80. 
i7‘i Heymann-Reder, Social Media Marketing, 2011, p. 20. 

173 http://www.tourismuszukunft.de/2015/12/world-of-social-media-plattformen/ (last accessed on 8 January 2019) 
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similar interests, generating opinions of many people and enabling users to get quick 
information on various topics and thus benefit from the knowledge and experience of 
other users, e.g. Facebook.com, Twitter, Tumbir, Xing, Google+, Linkedin. Social 
sharing platforms, by contrast, are platforms for the provision, administration, 
description, classification, indexing, linking and exchanging of multimedia content 
between users. FlickR, Instagram and YouTube are given as examples.Scientists, 
for their part, sometimes differentiate according to the intensity of social presence as 
achieved through the rich media content and the users’ self-presentation/self- 
disclosure. 

171 Market statistics and market research institutes mostly name a certain selection of 
major social media platforms when talking about social networks. Among them are 
normally Facebook.com, Twitter, Google+, YouTube, Instagram, Pinterest, Snapchat 
and/or WhatsApp, Tumbir, Xing and/or Linkedin. 

172 To define Facebook’s competitive environment and market, the Bundeskartellamt 
enquired with Facebook.com and other networks, in particular Google+, Stayfriends, 
StudiVZ, Xing, Linkedin, Twitter, YouTube, Yahoo Messenger, Skype, Snapchat, Yelp, 
Jappy, WizeLife and Lokalisten. When asked about their competitors, these companies 
also named a few other close competitors, among them Vimeo, Flickr, Apple Foto, 
Skype, WhatsApp, WeChat, Viber, Line, Seniorbook (now WizeLife), Stepstone, 
Indeed, Instagram, Pinterest, Facebook Messenger, Google Hangouts and Facetime. 

173 To define Facebook’s market and major competitor relations, the Bundeskartellamt 
also commissioned a representative social media survey. 

174 The user survey started by posing an open question regarding the definition of services 
as “social networks” from the users’ point of view. Question 4 read as follows: “When it 
comes to social networks, which services do you use? Please state all services you 
use, even if you rarely use them." 

175 The respondents gave the following answers: 


cf. e.g. https://webconsultinq-stuhec.com/bloa/social-media-plattformen (last accessed on 10 January 2019) 

Kaplan/Haenlein, Users of the world, unite! The challenges and opportunities of Social Media, Business 
Horizons (2010) 53, 59, 62. https://de.slideshare.net/Twittercrisis/kaplan-and-haenlein-2010-social-media (last 
accessed on 10 January 2019). 

Cf. e.g. ARD/ZDF online survey (in German), Mediaperspektiven 9/2016, p. 434 - http://www.ard-zdf- 
onlinestudie.de/fileadmin/Onlinestudie 2016/0916 Koch Frees.pdf (last accessed on 10/01/2019) . 
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Which services do you use? 

Named at least one 

79% 

of which: Facebook 

75% 

WhatsApp 

37% 

Twitter 

15% 

Instagram 

13% 

Xing 

11% 

LInkedIn 

5% 

Snapchat 

4% 

YouTube 

4% 

Google+ 

4% 

Stayfriends 

4% 

Pinterest 

2% 

Tumbir 

2% 

Threema 

2% 

Named no service 

21% 

Statistical population n =1041, includes alternative spellings (e.g. FB, whats up, etc.) 


176 Less than 1.5% of the respondents stated the following services: archive of our own, 
blogger, brieffreunde.de, change.org, dbna, deviantart, ello, evernote, Finya, Flirttown, 
FutureNet, FragMutti, GayRomeo, Google Alio, gmx.de, grindr, GROWLr, Hotmail, 
ICQ, idealo, 1-Message, Jappy, jodel, kik Messenger, kwick, Lovoo, MySpace, Nasza 
klasa, LINE, Lokalisten, Microsoft Cloud, medium, Moodle, Odnoklassniki, Periscope, 
Platinnetz, Plaxo, researchgate. Signal, Skype, spin, Sportstracker, Spotify, Steam 
Discord, reddit, Strngrz, StudiVZ/MeinVZ/SchulerVZ, stumbleupon. Telegram 
Messenger, Viber, Vine, VK, Wattpad, WeChat, Weheartit, Wer-kennt-wen, 
Wurzelwerk, Twitch, zazeni, VK, 500px und 9GAG. 

177 The following multiple-choice question referred to services, which were shown to each 
respondent in random order. It contained the term “social media” and read as follows: 
“Please find below a list of various social media services. Please state whether you use 
them, and how frequently you use them. 

Facebook 

Google+ 

LInkedIn 
- Xing 
My Space 
Stayfriends 
WhatsApp 
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Threema 

Telegram 

- IMessage 
YouTube 
Snapchat 
Instagram 
Twitter 
Pinterest 
Tumbir 

- Viber 
Reddit 

Odnoklassniki.ru 

ok.ru“ 

178 The list of services is largely identical with the list of most frequently stated services in 
open questions and only contains a few services more than previously stated. 

(2) Services considered 

179 On this basis, the Bundeskartellamt considered in particular the following services 
besides Facebook.com, Facebook Messenger (see para. 15 above), Instagram and 
WhatsApp (see paras. 74ff. and 83ff.) when defining the market as an environment of 
services: 

180 Apple Foto is a photo management program for Mac OS X (Desktop) operating systems 
and the mobile iOS system by the US-based company Apple Inc. It has been pre¬ 
installed on iPad and iPhone devices as a standard since 2014 and on Macintosh 
computers with Mac OS X since 2015. Besides organising, editing and presentation 
functions, Apple Foto also has a sharing function enabling bilateral sharing of Fotos via 
Mail, the iCIoud cloud service or wireless sharing via AirDrop, and posting of pictures 
on Twitter, Facebook, Linkedin, Vimeo and Flickr for users who have an account with 
these services. 

181 FaceTime was launched by Apple Inc. in 2010. The service offers IP telephony and 
video conferences via its own application software for the Apple MacOS and iOS 
operating systems. It is a standard pre-installation on Macintosh computers and iPad 
and iPhone devices. 

182 Flickr ( www.flickr.com) has been available in Germany since 2007. It is a service free 
of charge originally founded by the US-based company Yahoo Inc. and was sold to 
SlugMug in April 2018.^^® Besides photo management, editing and organisation, Flickr 
allows users to shoot short videos with a maximum duration of three minutes, add 
comments and notes to them, load them onto the website and share them with other 


https://www.heise.de/foto/melduna/Yahoo-verkauft-Flickr-an-SmuaMua-4028953.html (in German, last 
accessed on 10 January 2019). 
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users. Users can also search for key words and look at photo streams (photo blogs as 
user profiles) by other users and comment on photos by adding picture sections. Use 
of the service is subject to registration. With their profile, users can use the service both 
as a web-based service and via a mobile app for standard mobile operating systems 
(Android and iOS). 

183 Google+ ( www.qooqleplus.de) was launched as a free service in 2011. Friends, 
relatives and other acquaintances can connect via this platform. Google-i- was also 
offered as part of the “G-Suite”, a paid service, in spring 2018. The Google+ enterprise 
version is part of a range of software and office applications for internal company 
organisation. Formerly known as “Apps for work", these apps are now part of the “G 
Suite" brand, and cost between €4 and €23 per employee of the company.^®® Within G 
Suite, Google-i- is supposed to offer social networking functions to support personal 
networks within the company.^®^ Depending on the settings, the visibility of contents 
can be limited to staff members of the company or extended to public circles. In October 
2018 Google announced that the service would be discontinued for private users. 
However, in assessing the dominant position, the Bundeskartellamt considers the 
market position Google-r used to hold. 

184 Google Hangouts ( www.hanqouts.qooqle.com) is a service launched by Google in 
2013. Users who have a Google account can use it via an app, a website, or as a 
function of Gmail, Google-i- or Inbox. Hangouts allows users to share text messages, 
photos, videos, stickers or locations either bilaterally or in groups. Video conferences 
are also possible. 

185 iMessage is a service by Apple Inc. for devices with Apple Mac OS X and iOS operating 
systems. Users have to register once with their Apple ID or phone number. It is a 
standard pre-installation on Mac computers and iPhone and iPad devices. The service 
offers a bilateral exchange of photos, texts, videos and other files. iMessage is linked 
to iPhone’s messages app and starts automatically if the recipient also uses an iPhone 
and has it switched on. 

186 Indeed ( http://www.indeed.com) is an online job search portal which was founded in 
2004. The service is now also available as an app for smartphones. It is part of the 
Japanese Recruit Holdings & Co. Ltd. and offers a platform for publishing job adverts 
free of charge in a simple version and subject to payment in various premium options. 


[...] https://qsuite.qooqle.com/intl/de/pricinq.html ( last accessed on 10 January 2019). 

https://www.cloudcomputinq-insider.de/apps-fuers-business-was-ist-qooqle-q-suite-a-691517/ (in German, 
last accessed on 10 January 2019). 

https://www.blog.google/technology/safety-security/project-strobe/ (last accessed on 10 January 2019). 
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Companies can build their own recruiting sites. Job seekers can register for free and 
create and upload their CVs. 

187 Jappy ( www.iappv.de) is a free contact and communication service in Germany which 
has been operated by Jappy GmbH since 2001. To participate, users need a user 
profile containing basic data like user name, place of residence, age and sex. They can 
add further data (occupation, relationship status, name, etc.) or pictures and share it 
with other users if they wish to. Users can befriend other users or subscribe to the 
contents of other users. Unwanted contacts can be blocked via contact filters or 
blocking functions. Users find other users via the exploration system (public status 
messages suggested by the system), the recommendation system (“People you may 
know”) or active research via the user search function. Communication can take various 
forms, e.g. chats, status messages, guestbook entries, group forums, comments, and 
feedback icons. Users are rewarded for their activity on the platform and receive a 
credit voucher depending on their rank every Sunday. A member’s rank will rise and 
fall according to his activity. With these credits, users can make virtual gifts or share 
emoticons or unlock further functions (e.g. new status pictures, new emoticons). 
Additionally, every member can activate a flirting option. Jappy is financed through 
advertising and offers targeted advertising services. 

188 Lokalisten was a service provided by Unterfdhring-based Lokalisten Media GmbH, 
which was majority-owned by ProSiebenSat.1 Media. The focus of this service was to 
connect users from the same region. Founded in 2005, the service was discontinued 
in September 2016 after a significant amount of members had left the platform. For this 
reason, the service is no longer taken into account when defining the market. 

189 Line is a free service provided by the Japanese Line Corporation (Tokyo), which 
belongs to the Korean Naver Corporation (Seongnam). The service has been on the 
market since 2011. The mobile app is available in several languages and for various 
operating systems. Users can make voice and video calls and send text messages. 
The app has a timeline function to communicate with friends through texts, pictures, 
films, stickers and other message forms. 

190 Linkedin ( www.linkedin.com) is operated by the US-based company Linkedin Inc. and 
has been owned by Microsoft Corp. since December 2016. Since 2003, Linkedin has 
been offering an international online platform for maintaining existing business contacts 
and making new ones. Most functions of the platform are fee-based. The service is 
available via the web or a mobile app. Its focus is on creating a professional online 
identity and linking in with other users and companies for career development and 
training opportunities. Personal and corporate profiles can be created in several 
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languages. Users can make new contacts and recommend other members. They can 
also enter links to their own websites and found or become members of groups for 
certain topics. The company also offers search and recruiting tools. A premium 
membership costs between €26 and €90 per month. The free standard account offers 
some basic functions for setting up a profile and receiving messages. 

191 MySpace ( www.mvspace.com) is a service of the US advertising company Specific 
Media Inc., which acquired the service from the US-based News Corp. media group in 
2011. MySpace has been on the market since 2003 and has been available in Germany 
since 2007. It was relaunched in 2012. Users had to re-register as a result. MySpace 
is a free multilingual service offering its users to set up profiles containing photos, 
videos, blogs, groups, lists of friends, etc. The service has a clear focus on music and 
was originally also created for unknown artists and bands enabling them to reach a 
potential audience. The musicians published information about new albums and tour 
dates. Most bands also offered audio samples of their music. Additionally, users can 
create individual sites to provide information on themselves. The service is available 
via the web or a mobile app for the standard operating systems. 

192 Odnoklassniki (English: classmates, www.ok.ru) is a Russian service of the Russian 
MaiI.Ru Group investment company and was launched in 2006. Users can set up 
profiles in various eastern European languages and in English free of charge. Profiles 
can contain various pieces of personal information as well as photos, lists of friends, 
groups, forums, etc. They can look for friends and make contact with other members. 
Schools from all over the world can be entered. Users can play online games together, 
link YouTube videos and listen to music for free. 

193 Pinterest ( www.pinterest.com) is a service of the US company Pinterest Inc., Palo Alto, 
which was launched in 2010 and describes itself as a “catalogue of ideas people use 
to plan the big and small projects of their lives”. Besides pictures on various topics (e.g. 
cooking, travel, beauty), users can find additional information (e.g. the provider’s e-mail 
address). Users have to register. Their profile allows them to create their own contents 
by creating their own “boards” to post “pins” on. The standard privacy setting for 
pictures is “public”. However, users can create “secret boards” for their own use only. 
Users can “follow” other users and generate “followers” themselves. The service is 
available via the web or a mobile app for the standard operating systems. 

194 Reddit ( www.reddit.com) is a mostly English-language service provided by the US- 
based Reddit Inc. It was launched in 2005 and is used for exchanging news. Users 
have to register. With their profile, they can post external links or their own postings on 
Reddit. Postings the users create themselves contain texts on selected topics. Other 
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users can comment and vote on their postings. Authors receive rating points for 
postings or comments which other users rate as positive. The service is available via 
the web or a mobile app for the standard operating systems. 

195 Skype ( www.skvpe.com) is a service launched in 2003. It was purchased by Microsoft 
Corp. in 2011. Skype customers can use the service to make free phone calls on 
Skype. Phone calls to landline or mobile phone numbers (“skype out”) can be made for 
a fee. Skype supports videoconferences and exchanges of text messages and other 
files.^®^ The service is available via the web or a mobile app for the standard operating 
systems. 

196 Snapchat is a service of the US-based company Snap Inc. and was launched in 2012. 
The service offers a mobile app for smartphones enabling users to send photos and 
videos (“snaps”) to friends free of charge. The pictures and videos are only visible for 
a limited amount of time. Photos and videos can be edited with filters and stickers. 
Users register with a simple profile. Only contacts specified by user name or snap code, 
or users from the address book can be searched and found. Individual snaps can be 
joined together in an album which is called a “story”. A story can contain photos, videos 
and pictures and is visible to friends for up to 24 hours. Users can also save snaps in 
their “memories” to be able to access them on a permanent basis. 

197 Stayfriends, ( www.stavfriends.de) is a service available under that name in Germany, 
Austria, Switzerland, and Sweden. In France, it is known as Trombi ( www.trombi.com) . 
It was launched in 2000 and acquired by Strder SE & Co. KGaA in 2016. The service 
helps users find former classmates and offers a virtual space for users to reconnect 
with people they knew at school, assemble memories and photos and stay in touch 
with these people.Users set up their profiles and lists of contacts and contact others 
bilaterally via an integrated messenger service. The service is offered as a “freemium” 
service, i.e. a basic version of it is free while additional services or the whole service 
package are available for a fee. Most functionalities of StayFriends are only available 
for gold members who pay an annual fee of approx. €30. 

198 Stepstone ( www.stepstone.de ) was launched in 1996 and known as “Jobshop” until 
2000. It has been owned by Axel Springer SE since 2008. The service offers an online 
job market for experts and leaders. Companies can post job adverts for a fee. Posting 
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a job advert for 30 days costs between €900 and €1700The service is available free 
of charge for job seekers. The site offers various search filters for job adverts. 

199 StudiVZ ( www.studivz.de) is a German portal financed through advertising. It was 
founded as a subsidiary of the Holtzbrinck publishing house in 2005 and designed as 
an online community for students. Related platforms, SchulerVZ (for pupils) and 
MeinVZ (general social network) were founded in 2007 and 2008, respectively, to reach 
further target groups. The services expanded to other European countries. The service 
has focused on the German market since 2009 and now belongs to Poolworks 
(Germany) Ltd. SchulerVZ was discontinued in 2013. While Poolworks disclosed its 
bankruptcy in September 2017, the services StudiVZ and MeinVZ are to stay in 
business.^®® The service offers users to connect with each other free of charge by 
setting up a profile which can contain various pieces of information. They can search 
other students and see links to other contacts. Users can form discussion groups, 
create “photo albums” and upload photos. Its functions include a chat function called 
“Plauderkasten”, a video series and a messaging function called “Buschfunk”. The 
service is available as a web service and as a mobile app for standard operating 
systems. 

200 Telegram ( www.telearam.ora) was founded in 2013 by the Russian entrepreneur Pavel 
Durov, who also used to own the popular Russian social network vk.ru which has been 
taken over by the Mail.ru Group in the meantime. Telegram’s affiliation is unclear. The 
providers Telegram Messenger LLP, Telegram LLP, Telegram LLC or Digital Fortress 
LLC are stated as the providers in app stores. All of them are considered phantom 
companies and associated with various offshore companies.The service is available 
free of charge as a web service, PC application software, and as a mobile app for 
various operating systems. Users can exchange text messages, encrypted messages, 
photos, videos and documents. They can define a period of time after which the end- 
to-end encrypted “Secret Chats” disappear automatically (messages and media). 
Several people can chat simultaneously about a certain topic via public and private 
“channels” without their names appearing as authors of the messages. 

201 Threema ( www.threema.ch) is a service based in Switzerland, which is operated by 
Threema GmbH and was launched in 2012. Via the service, users can exchange texts, 
videos and voice messages. It also offers group functions, surveys, and a voting 


https://www.stepstone.de/content/de/de/downloads/StepStone Produkte&Preise.pdf (in German, last 
accessed on 10 January 2019). 

https://www.heise.de/newsticker/melduna/StudiVZ-Betreiber-Poolworks-ist-insolvent-3825444.html (last 

accessed on 10 January 2019). 

Cf. e.g. https://www.aruenderszene.de/allaemein/telearam-berlin-oder-nicht (available in German only, last 
accessed on 10 January 2019). 
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function. The service can be used with a payable smartphone app, but it is also 
available as a desktop version. 

202 Tumbir ( www.tumblr.com) was launched in 2007. It is a mostly English language 
service provided by the US-based Tumbir Inc., which was acquired by Yahoo Inc. in 
2013. The service is available as a smartphone app and as a web application. Upon 
registration, Tumbir users automatically get their own blog. A blog can be filled with 
various content formats (photos, GIFs, links, Spotify tracks, MP3s, videos, etc.). Users 
can design their blog individually and operate several blogs simultaneously. Tumbir 
blogs are always public. In their “Tumbir Backend”, users can see the blogs they 
subscribed to. Tumbir does not have a comments section. Users interact with other 
users by tagging them as “favorite” and by “reblogging” posts (i.e. posting them in their 
own blog with a link to the original source). Blogs can include a hashtag (#) to make 
sure they can be found via the search function. 

203 Twitter ( www.twitter.com) is an international service by the US company Twitter Inc., 
which was launched in 2006. Users can post telegram-style short messages of a 
maximum length of 280 characters (“tweets”) for free. The service is therefore often 
categorised as a “microblogging” service.^®® Tweets can also include photos and 
videos.^®® Users can link individual words in a tweet using the hashtag (#) symbol. Other 
users can share (“re-tweet”) a user’s tweet and subscribe to a user’s content by 
becoming his “follower”. They will see a chronological list of tweets by users they follow. 
All users must register and can set up a user profile. Twitter is available via the web or 
a mobile app for the standard operating systems. 

204 Viber is a service of Viber Media S.a.r.l. Founded in 2010, it has belonged to the 
Japanese Rakuten K.K. company since 2014. The service offers IP telephony services 
in particular. For this purpose, Viber does not require user names. Instead, it uses the 
available mobile phone numbers. The service is only available to users who have the 
corresponding Viber software, either as a mobile app or on their desktop computer. 
With Viber, users can also send text messages, photos, videos and locations.^®® 

205 Vimeo ( www.vimeo.com) is a video portal of the US-based InterActive Corp., which 
was launched in 2004. Vimeo is considered a portal for professionals offering a 
“freemium” model. Its main target group are film makers. Other than artistic videos, 
there are also many professionally produced video tutorials and online courses, which 


http://www.faz.net/aktuell/feuilleton/twitter-hebt-das-zeichenlimit-auf-15221037.html (in German, last accessed 
on 10 January 2019). 

http://www.spieqel.de/netzwelt/web/twitter-erlaubt-etwas-mehr-als-140-zeichen-a-1112992.html (in German, 
last accessed on 10 January 2019). 

http://www.vlber.com/about (last accessed on 10 January 2019). 
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can only be viewed for a fee. Users exclusively wishing to use Vimeo for looking at 
videos do not need to register. To actively use the portal, a registration including the 
name, e-mail address and a password is necessary. A user profile can contain 
additional information on the users’ CV or places of residence. Users can also upload 
a profile picture. Vimeo’s basic version is free. The basic version contains advertising 
banners and has a data limit for video uploads. Vimeo's Plus membership (approx. €50 
per year) and Pro account (approx. €160 per year) do not display advertisements. 
Users have to produce the content they upload themselves, at least to a significant 
extent, i.e. users have to be the creators of any video they upload. As a general rule, 
the content must not contain advertisements. Users can set up their own channels and 
blogs, join groups on certain topics and subscribe to channels of others and comment 
on them. 

206 WeChat is a free Chinese service operated by the Chinese company Tencent since 
2011, which is also used by international users. WeChat serves to share audio and 
video files. It also contains further functions, e.g. for ordering taxis, groceries or food 
and paying via a payment function.The app has its own app store. Users can look 
for people near them, play games, buy stickers, pay their restaurant and electricity bills, 
look for a job, book doctor’s appointments or operate their own mobile stores. 

207 WizeLife (formerly: “Seniorbook”, www.wize.life) is an advertising-funded service 
which was launched in 2012 and is operated by Munich-based Seniorbook AG. The 
service addresses users aged 40 or older and is an online contact and communication 
service for exchanging experiences and meeting people with shared or similar 
interests. Users can enter a detailed profile on WizeLife or the mobile app. The service 
recommends using the real name and place of residence for that purpose. By entering 
topics, using the chat function and entering counties/places in which the members live, 
they can find like-minded people online and meet them in person too. Members can 
communicate via local groups, get information on events or make appointments. 

208 Xing ( www.xinq.com/en) is operated by Xing AG and majority-owned by Burda Digital 
GmbH in Hamburg, which is a subsidiary of Hubert Burda Media Holding KG in 
Offenburg. The company’s online service for making and maintaining business 
contacts has been available in Germany, Austria and Switzerland from different 
websites since 2003 (initially under the name OpenBC), mostly for a fee.^®^ Users can 
develop a professional network, find job adverts matching their profile and information 
relevant to their industry or profession to keep up to speed with developments in their 

https://web.archive.ora/web/20160310160456/http://www.diaitalkompakt.de/uebersicht/wechat-messenqer/ (in 

German, iast accessed on 10 January 2019). 
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professional livesJ®^ Membership is subject to registration. The (basic) membership is 
available free of charge and offers very limited functionalities compared to the premium 
membership which is available for a fee. Users can set up a detailed profile containing 
both professional and private information. The profile includes an overview of a user’s 
degree, vocational training and career path, similar to a CV. Users can stay in touch, 
use XING’S public event calendar and an appointment function. A multitude of 
discussion fora is available, some of which are public, and some of which are only 
accessible for a limited circle of users. In addition to the online offer, users can join 
regional groups organising local meetings for personal contacts. 

209 US-based Yahoo Inc. had offered Yahoo Messenger as a service free of charge since 
1998, which could be used as an app or as a function of the YahoolMail service as a 
desktop version.The service has been discontinued since 17 July 2018^^® and is 
therefore not taken into account for this assessment. 

210 Yelp ( www.velp.com) has been on the market since 2004 and belongs to the US-based 
company Yelp Inc. It is a review and recommendation portal for restaurants and shops 
which focuses on reviews entered by users. Users can enter a postcode and a key 
word and look for regional suppliers from various categories (e.g. food and drink, 
shopping, beauty, healthcare and doctors). They can also review services, add their 
own photos or share entries with other users. To do so, they have to register and create 
a user profile. Finally, the platform also allows users to book a table at a restaurant or 
to buy a gift voucher.^®® The service is available via the web or a mobile app for the 
standard operating systems. 

211 YouTube ( www.voutube.com) is a video portal founded in 2005 by YouTube, LLC, San 
Bruno/USA, which was acquired by Google Inc., Mountainview/USA in 2006. The portal 
is available as a web service or app for all standard operating systems, and as an app 
for smart TVs. Users can upload their own videos to this platform and set up their own 
“channel” containing a playlist of all videos a particular user has uploaded. They can 
select an individual design for their channel, e.g. by changing the title image, the 
channel title, or by adding or deleting modules like playlists. Other users can view the 
videos and subscribe to channels. They can comment and rate individual videos. While 
YouTube can be used without registration, its use is then restricted to viewing videos. 
The service is financed through advertising. Advertising is in most cases part of the 
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videos themselves (“in-stream ads”), displayed as so-called “pre rolls” prior to starting 
the video or as “mid rolls” while the video is playing. The channel has to be made a 
member of the YouTube partner program if it is to contain advertisements. Since spring 
2017, membership of the YouTube partner program is conditional on the channel 
having 10,000 views. Further ads are displayed next to the running video and in the 
search results. The advertisements are targeted and matched individually based on the 
videos the user has previously watched, according to YouTube. The interests and 
advertising settings of registered users are considered. Once a user is registered, the 
apps on his/her device and the way these are used, the websites visited, the linked 
mobile device ID, geo data, age, sex and previous interaction with videos and Google 
adverts are evaluated. 

b. National market for social networks 

212 Facebook’s activities for private users take place on the national market for social 
networks. As a network and market side of a multi-sided market within the meaning of 
Section 18(3a) GWB (see 1), the service Facebook.com is attributable to a separate 
social network market as a submarket of social media (see 1), which is defined as 
national (see 3). 

(1) Network and multi-sided market pursuant to Section 18(3a) GWB 

213 With its service Facebook.com Facebook offers an intermediary product by way of its 
service content, which is a combination of a network and a multi-sided market pursuant 
to Section 18(3a) GWB. 

(a) Core product: Advertising-financed network 

214 The product Facebook.com is a network financed through targeted advertising, which 
forms a multi-sided market as a result. 

215 Network effects and its intermediary function as a product definition are particularly 
relevant when it comes to defining the market. Typically, multi-sided markets are thus 
services facilitating, as intermediaries, direct interaction between two or more user 
groups between which network effects exist .Networks are thus typically companies 


Legislative intent on the 9th amendment to the German Competition Act (GWB), Bundestag printed paper 
18/10207, p. 49. For a detailed definition of platforms, see BKartA Working paper on the market power of 
platforms and networks (“Arbeitspapier Marktmacht von Plattformen und Netzwerke”), June 2016, p. 8 ff. 
downloadable from httDs://www.bundeskartellamt.de/ShareclDocs/Publikation/EN/Berichte/Think-Tank-Bericht- 
Lanafassuna.pdf? blob=publicationFile&v=2 -. examples from relevant literature include: Caillaud/Jullien, 
“Chicken & egg: competition among intermediation service providers" RAND Journal of Economics, 2003, 
34(2), 309-328; Armstrong, “Competition in two-sided markets", RAND Journal of Economics, 2006, 37(3), 
668-691; Rochet/Tirole, “Two-sided markets: a progress report", RAND Journal of Economics, 2006, 37(3), S. 
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acting as intermediaries providing services that enable interaction between users of the 
same group, which results in the creation of direct network effects.^®® However, it is not 
always possible to strictly separate both forms of intermediation services, as is also 
shown by the present case. In practice, business models often combine platform and 
network elements. 

216 Key user groups include mostly private users, who use Facebook.com without any 
monetary payment, and advertisers who pay a fee to place targeted advertisements 
based on the users' data on user websites or in the Facebook app. 

217 For private users, Facebook.corn’s main service is to offer functions for finding friends 
and acquaintances and for sharing various types of content in specifically defined 
private user groups, as is outlined under para. 19ff. above. As Facebook acts as an 
intermediary by enabling interactions between its users and positive direct network 
effects occur within the private user group, the service constitutes a network within the 
meaning of Section 18(3a) GWB. Direct network effects exist where members of a 
group directly benefit from either a higher (positive direct network effects) or a lower 
(negative direct network effects) representation of members of their group on the 
platform.^®® 

218 The group of Facebook.com users directly benefits from more members using 
Facebook.com because of effects occurring between the individual private users within 
a group. The connection between the users that leads to the network effects can be 
both direct and indirect. Social networks are mainly characterised by direct network 
effects developing between their members. They primarily serve to connect friends and 
acquaintances and to enable communication between them. The more private users 
are active on Facebook.com, the higher the benefits for this user group as the options 
for users to interact and find friends and acquaintances increase with an increasing 
number of users in the social network. The network effects are “identity-based” because 
the users’ identity rather than just the number of users is relevant in this context. 

219 Facebook.com offers the scope, attention and data generated by its private end 
consumers and the advertising space available within the service as a key service to 


645-667. Hagiu/Wright, “Multi-sided platforms", Working Paper, 2015, Harvard Business School, 
httD://www.hbs.edu/facultv/Publication%20Files/15-037 cb5afe51 -6150-4be9-ace2-39c6a8ace6d4.Ddf. (last 

accessed on 10 January 2019). 

198 Working paper, government reasoning and literature: Cf. for example Katz/Shapiro, “Network Externalities, 
Competition, and Compatibility", The American Economic Review, 1985, 75(3), p. 424-440; Farrell/Saloner, 
“Standardization, Compatibility, and Innovation", The RAND Journal of Economics, 1985, 16(1), p. 70-83; Shy, 
“A Short Survey of Network Economics", Review of Industrial Organization, 2011,38, p. 119-149. 

see also: Bundeskartellamt, working paper "Market Power of Platforms and Networks", June 2016, p. 9 ff., 
downloadable from https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Berichte/Think-Tank-Bericht- 
Lanafassuna.pdf? blob=publicationFile&v=2 ( last accessed on 10 January 2019). 
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advertisers. The company’s offer is financed through advertising and thus constitutes 
a multi-sided market pursuant to Section 18(3a) GWB, because Facebook acts as an 
intermediary facilitating the direct interaction between advertisers and private users 
between whom indirect network effects exist. 

220 Based on the user data and the users’ awareness while using the social network, users 
and advertisers can directly interact via Facebook, e.g. when following up the users’ 
response to an advertisement (by clicking on the advertisement, for example). As the 
platform provides advertisers with an audience, i.e. its other user group, it can be 
referred to as an audience providing platform.^”® As a result, indirect network effects 
occur between the group of private users and the group of advertisers. Indirect network 
effects exist where the benefit or gain of users in one group depends on the number of 
users from another group. Looking at the effects, it makes sense to differentiate 
between cases where the members of one user group benefit whenever the 
membership of the other group on the platform increases (positive indirect network 
effects), and cases where they benefit whenever the other group’s membership is 
smaller (negative indirect network effects). 

221 Audience providing platforms like Facebook.com typically show intensive positive 
indirect network effects for advertisers. The benefits of a social network for advertisers 
increase with an increasing number of users. The larger the group of users in the right 
target group, the more sales opportunities exist for an advertiser. With its many users, 
Facebook.com represents a large number of different target groups. However, the two 
sides have different notions of the desirability of an interaction between the advertiser 
and the user and of being provided with an audience or being the audience, 
respectively. The indirect network effects are thus less positive or even negative. 
Private users of a social network typically want to use the network functionalities and 
either merely accept targeted advertising or even find it annoying. The benefits for 
users of social networks do not increase with an increasing amount of (targeted) 
advertising to an extent that would be comparable to the benefits of a large user base 
for advertisers. This statement is supported by the outcome of a user survey according 
to which the large majority of users consider targeted advertising either as negative or 
as neutral.2°2 

222 Graphically, the core platform can be illustrated as follows: 


Cf. BKartA, Working paper "Market Power of Platforms and Networks”, June 2016, p. 24f. 

201 Cf. BKartA, Working paper "Market Power of Platforms and Networks”, June 2016, p. 9f. 
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(b) Further market sides 

223 With the social network functions for publishers (cf. para. 32) above) and the developer 
platform (cf. para. 150 ff. above), Facebook has added further market sides to its core 
product of an advertising-financed network, which are also part of the multi-sided 
market from an economic point of view. 

224 Publishers use Facebook.corn’s social network, as described, to make their own 
company or business known among Facebook users by creating a page in the network. 
On their Facebook pages, operators can publish their editorial content, connect with 
users, monetise their websites and gather information on user behaviour. 

225 Again, Facebook acts as an intermediary between private users and publishers to 
facilitate direct contact via the social network. Indirect network effects exist between 
the user groups of publishers and private users with regard to the marketing purpose. 
On Facebook.com, commercial site operators benefit from an increased scope and 
higher awareness due to the growth of the private user group. 
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226 For developers, Facebook offers, as described above, the opportunity to integrate their 
web-based offers (websites or apps) into Facebook.com to increase their user base 
and to monetise their service. 

227 The products of Facebook’s developer platform (cf. para. 150ff. above) have to be 
considered multi-sided markets or market sides added to the social network as an 
audience providing platform. Customers of the developer platform and the Facebook 
Business Tools use Facebook’s large scope and its database to pursue the objectives 
they set out to achieve when integrating the tools. Facebook thus acts as an 
intermediary again when it comes to the tools, as it facilitates direct interaction between 
private users and developers. Depending on what the interfaces allow, various types 
of interactions can take place. Developers of Facebook apps can use Facebook as an 
interface, e.g. to make their apps available for use to Facebook users. Users of social 
plug-ins can share contents on Facebook.com by clicking the “Share” or “Like” buttons 
on the developer’s website. 

228 Indirect network effects exist between developers and private users; their exact nature 
depends on the respective tool. The developers’ benefits always increase with a 
growing number of private users in the social network. Conversely, positive indirect 
network effects exist for a large number of products, e.g. the tools for developing 
Facebook apps. The social network’s attractiveness for private users increases with a 
growing number of apps. As far as other interfaces, e.g. the Marketing API, are 
concerned, the benefits for private users of a growing number of developers using them 
are less pronounced, which is similar in the case of advertisers. 

229 Taking these sides into account, Facebook’s role can be illustrated as follows: 
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(2) Definition of the product market 

230 Based on the criterion of demand-side substitution, the investigations have shown that, 
from the private users’ perspective, there is a market for social networks in terms of 
characteristics, application and price. The relevant opposite market side are private 
users (see a). A market can be defined although the service is available to private users 
free of charge (see b). In the context of social media, social networks meet a specific 
demand private users have (see c). Only StudiVZ, Jappy and, until it was discontinued, 
Google-i- can be included in the market, whereas all the other services represent 
competition from substitutes (see d). 

(a) Relevant opposite market side: private users 

231 The relevant opposite market side to determine the substitutability of social networks 
with Facebook.com is represented by the private end consumers. They form a separate 
market side apart from the other user groups of the social network, i.e. advertisers, 
publishers and developers. 

232 The market sides of the multi-sided market are not a uniform opposite market side. 
For the user groups of advertisers, publishers and developers, Facebook meets 
different requirements than for private users. 


















65 


233 Generally speaking, the Bundeskartellamt considers it possible to carry out a uniform 
market definition which does not differentiate between different user groups, especially 
if the product, which is an intermediary product, does not exist unless several user 
groups use it to a sufficient extent.A uniform market definition that comprises several 
or all market sides has to consider the criterion of demand-side substitutability. It can 
only be assumed to apply if all the user groups have essentially the same view of the 
service’s functional substitutability, i.e. if they have mostly similar requirements. 

234 Facebook.corn’s various user groups are not essential to creating a social network as 
a service. The groups’ requirements are not largely similar to those of private users 
either. 

235 In particular advertisers using Facebook.com for targeted advertising have different 
requirements and thus generate the market side of an audience providing platform. 
Audience providing platforms generally cannot be defined as a uniform market. As the 
product, i.e. the social network, is not conditional on the other side being represented 
as well, this side is not required for the product. By adding the advertisers' side, the 
company rather monetarises an existing product, i.e. its service, by offering advertising 
space within that service. The advertising side is added on the basis of a decision to 
generate funding through advertising rather than being a result of the social network’s 
intermediary function. A uniform market definition is not required for taking into account 
the indirect network effects, either. As has been shown, the platform is characterised 
by asymmetrical indirect network effects: Clearly positive indirect network effects 
emanate in particular from the (free) user side to the benefit of the advertising side, as 
the platform’s benefits for advertisers increase with an increasing number of users on 
the other side. Conversely, an increasing number of adverts on the platform do not 
normally increase the benefits for the other user group; the indirect network effects are 
hence less pronounced or even negative. Additionally, the requirements of private 
users on the one hand and advertisers on the other cannot be assumed to be identical. 
While advertisers use Facebook.com for marketing purposes, private users intend to 
use the social network functionalities to fulfil other requirements. It can also be 
assumed that the two user groups have different views on their options for substitution, 
although the advertising side is oriented towards their target group, which can lead to 


2°'* So-called matching platforms, cf. Bundeskartellamt, Working paper "Market Power of Platforms and 
Networks", June 2016, p. 22 ff., available at 

https://www.bundeskartellamt.de/SharedDocs/Publlkatlon/EN/Berichte/Thlnk-Tank-Berlcht- 

Lanafassuna.pdf? blob=publicationFile&v=2 (last accessed on 10 January 2019). 

BKartA- Parship/Elltepartner, B6-57/15, decision of 22 October 2015, para. 71 ff.; BKartA- Immonet/lmmowelt, 
B6-39/15, case summary of 20 April 2015; BKartA - P7S1/Verlvox, B8-67/15, case summary of 5 August 2015; 
BKartA - HRS, B9-66/10, decision of 20 December 2013; cf. Bundeskartellamt, Working paper "Market Power 
of Platforms and Networks", June 2016, p. 31 ff. 
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similar market definitions as the advertisements are mostly in line with the target 
group’s expectations.^®® 

236 The same is true for publishers, who also use Facebook.com to fulfil other 
requirements than private users. Publishers use Facebook.com in away that is closely 
linked to private use in many ways. From the private users’ perspective, this constitutes 
part of the functionalities of a social network. However, it cannot be assumed that the 
two user groups have the same requirements. Publishers use Facebook for other 
purposes than private users, namely to make their own company or business known 
among Facebook’s users through their own “page”. They thus first and foremost pursue 
marketing objectives and constitute a user group which has its own characteristics. 
Again, the options for substitution are different for each user group. 

237 And finally, developers have completely different requirements than private individuals 
when using the APIs. The different APIs are special software products which primarily 
serve to grant technical access to the social network and its users, hence its scope, in 
order to improve or monetise a product. For this reason, uniform demand from private 
users and developers cannot be assumed. 

(b) A service free of charge for users 

238 The service can be considered part of a social network market despite the fact that 
private users do not pay for using it. 

i. Market activity with free user services within the meaning of Section 
18(2a) GWB 

239 Despite the fact that private users do not pay a fee for using the social network, this 
service is to be considered a market activity as it fulfils the requirements of Section 
18(2a) GWB as far as the advertising side, which is payable, is concerned. 

240 Previous (national) case law had not recognised free platform use as a market because 
it considered monetary turnover and price-setting essential competitive parameters 
without which a market did not exist. The Dusseldorf Higher Regional Court also 
confirmed this with regard to an online transaction platform.By including Section 
18(2a) in the German Competition Act, the legislator basically acknowledged the 
possibility for free services to be classified as a market activity; however, the exact 
conditions for such a classification were left open. 


206 Cf. Bundeskartellamt, Case decision of 25 Aprii 2015, ref. B6-98/13 - Funke/Springer (TV programme 
magazines), avaiiabie at www.bundeskarteiiamt.de. 

207 Dusseidorf Higher Regionai Court, decision of 9 January 2015, fiie ref Vl-Kart 1/14 (V), para. 43 - HRS (juris). 



67 


241 The Bundeskartellamt holds that, from an economic and antitrust perspective, a user 
group that uses the platform service for free should at least be considered a market 
under competition law terms if it is connected to a paying user group. This is based on 
the consideration that there is a close connection between the activities of the platform 
on the advertising side and on the "audience" side. The activities of the platform 
therefore pursue one and the same business purpose irrespective of the side towards 
which they are directed.^®® 

242 This view is also reflected in the legislative intenP® which holds that this applies in 
particular in the case of platforms with varying degrees of indirect network effects 
between the market sides. According to this reasoning, this could lead to a situation 
where one side of a platform offered services free of charge which does not benefit 
from the size of the other platform sides at all or only to a limited extent. Advertising- 
financed services are cited as the typical example of a service available to one user 
group free of charge while the platform is financed through advertising. 

243 This view is also reflected in the European practice. In its more recent case practice 
(e.g. the Facebook/WhatsApff^° merger decision) the Commission examined several 
online markets, including (ad-funded) social networks, although users can use 
practically all of the services offered without any direct monetary compensation.The 
Commission had already followed a similar approach in the Microsoft/Skype case. In 
the abuse proceedings against Microsoft regarding the tying of a web browser or media 
player to its PC operating system Windows, the Commission and the Generai Court 
confirmed the existence of markets for both components despite the fact that they were 
at least to some extent offered for free.^^® In the Commission’s abuse decision of 27 
June 2017 against Googie for giving illegal advantage to its own price comparison 
engine®^"^, the Commission assumed Google was abusing its dominant position on the 
markets for general internet search engines in Europe even though such search 
engines are always offered to users free of charge.®^® For the sake of homogeneous 


Bundeskartellamt, Working paper "Market Power of Platforms and Networks”, June 2016, p. 36ff. 

Legislative intent of the Federal Government on the draft of the 9th amendment to the German Competition Act, 
Bundestag printed paper 18/10207, p. 48. 

21° European Commission, decision of 3 October 2014, Ref. COMP/M.7217 - Facebook/WhatsApp. 

211 See aiso para. 31 of the decision. 

212 European Commission, decision of 7 October 2011, Ref. COMP/M.6281 - Microsoft/Skype, para. 75 

213 European Commission, decision of 24 March 2004, Ref. COMP/C-3/37.792 - Microsoft, para. 402; European 
Commission, decision of 16 December 2009, Ref. COMP/C-3/39.530 - Microsoft, para 17ff; General Court, 
decision of 17 September 2007, Ref. T-201/04 - Microsoft, para. 927ff, 1088. 

21“* Availabie at httD://ec.europa.eu/comDetition/antitrust/cases/dec docs/39740/39740 14996 3.pdf (last 
accessed on 10 January 2019), para. 157ff. 

215 European Commission, decision of 27 June 2017, Ref. AT.39740, avaiiabie under 
http://ec.europa.eu/competition/antitrust/cases/dec docs/39740/39740 14996 3.pdf. p ara. 158-160. 
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competition rules within Europe, a change of the current practice in Germany therefore 
seems to be called for. 

244 As, pursuant to Facebook’s terms of service, a contract is concluded between 
Facebook.com and the private users, it can be left open whether Facebook.com’s 
service can be classified as a market within the meaning of Section 18(2a) GWB solely 
because its free service is part of a multi-sided market, or whether a contract or other 
exchange relationship has to exist. In addition, private users giving away their data can 
be considered part of an exchange relationship.^^® 

ii. Applicability of demand-side substitutability 

245 Private users can be considered customers in the context of the concept of demand- 
side substitutability, even if the services are available free of charge. Contrary to 
Facebook’s view^^^, the users’ time and attention which, according to the company, all 
internet services compete for, are not the defining market elements in this case. 

246 The fact that the users do not pay a monetary compensation for the private use of 
Facebook does not change the fact that they use the service to satisfy a certain 
economic demand, which makes them customers of Facebook’s product in an 
economic sense. In contrast to that, defining the market as a market for the users’ time 
or attention turns the users into the product. While many online services share this 
economic point of view and frequently make statements to this effect, competition law 
takes a different approach by looking at the demand of the opposite market side to 
define the relevant product market. There is thus no difference to paid services all of 
which ultimately compete for their customers’ incomes while budgets are limited, which 
does not make their market a “market for income”. The user remains a customer, even 
if the service is available for free. In this respect, time or attention and the data the 
users enter replace the fee and can be seen as a compensation for the service. This 
applies in particular to ad-funded services, which offer their users’ time, attention and 
data to advertisers in return for revenues. Ultimately, advertising markets are “markets 
for time” which consider the users’ time and attention to be a product. However, this 
point of view is restricted to the side of a platform which is only available for a fee. 
Section 18(2a) GWB has been set up precisely to eliminate this restriction. 

247 Facebook’s claim is not based on the necessary demand-oriented view and criticises 
the Bundeskartellamt's position, which is based on competition law, for ignoring the 


216 Cf. European Commission, decision of 27 June 2017, ref. AT.39740, para. 158-160. 
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view of third-party companies that know the market well.^^® Aside from the fact that, 
contrary to Facebook’s claim, most of the competitor survey does not support this point 
of view, the concept of demand-side substitutability is a concept to be considered under 
competition law when defining a market, irrespective of the companies’ expertise. The 
Bundeskartellamt also has no doubt that Facebook views its customers as the (data) 
centre on which its commercial interests are focused. Still, this view does not justify 
putting customers in the position of suppliers of time and attention. 

248 The demand-side oriented market concept is also perfectly suitable for determining the 
demand for free market services. From the customers’ perspective, the products can 
thus be differentiated by their properties and applications. Additionally, when defining 
the market, the “price amounting to zero” and the general significance of the willingness 
to pay can be considered. Facebook is therefore wrong in claiming that a price-oriented 
approach is impossible in the case of “free” services.^^® The fact that the SSNIP test as 
a methodological characteristic of the demand-side oriented market concept, which is 
only rarely applicable in practice anyway, does not apply to free services does not make 
the demand-side oriented market concept inapplicable. As a matter of fact, the factors 
of time and temporal intensity of use are product characteristics, especially when it 
comes to social media, and thus have to be considered when defining the market. 

(c) Specific demand for sociai networks 

249 Having investigated competitors and users, it can be assumed that there is a specific 
demand for social networks, which is fundamentally different from the demand for other 
social media. The key purpose of social networks is finding and networking with people 
the users already know, and to exchange on a daily basis experiences, opinions and 
contents among specific contacts which the users define based on identity. Providers 
meet this demand by offering the corresponding core functionalities which grant users 
a “rich social experience”. 

250 The competitors emphasise this rich social experience through communication and 
exchange with other users when explaining what social networks do for users.®®® The 
intention of social networks is to provide users with a comprehensive personalised 
“virtual space”.®®^ The network is to enable users to develop “authentic interpersonal 
relationships”.®®® The users’ own “virtual identities” are supposed to be at the heart of 
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their user experiences and can be set up by creating a personal profile and starting a 
list of friends. The purpose of a user’s online identity is supposed to be a virtual 
reflection of real life.^^^ All activities of users in a social network are related to their 
personal networks of friends and acquaintances, which creates a “highly personalised 
experience.’’^^'^ Value is added to any contents shared among the personal contacts 
within the social networks because it is embedded in the personal network of friends 
and acquaintances. Depending on their preferences, users can develop all kinds of 
activities in this virtual space. Such activities include entering and staying in touch with 
friends and finding people users used to know, sharing contents (either generated by 
the social network or by third-party websites), information on events, playing online 
games or buying and selling goods, e.g. via Facebook Marketplace. Facebook 
describes the key functions of its social network as “connect”, “communicate”, “share”, 
and “discover”. 

251 The outcome of the user survey confirms this description of demand. Contrary to 
Facebook’s view^^®, this description is in particular also based on the replies received 
from its competitors. In its user survey the Decision Division asked for reasons why 
social media are used (question 7), how frequentlyVne services are used and how much 
time is spent using the services (questions 5 and 5.3). It also enquired which reasons 
would be needed to switch from one service to another (questions 10 and 11). 

252 The survey shows that most users use social media to stay in touch with friends (90%), 
to write messages (90%), as a pastime (83%), to read contents provided by others 
(77%), to share their own contents (72%), to look for people they know (65%) and to 
organise events (52%). Less than half of the users use social media to follow 
companies or celebrities (50%), for professional contacts (41%), for news updates 
(36%), to meet new people (24%), to promote their own website (15%) or to play games 
( 13 %). 227 

253 The survey showed that users basically use Facebook.com for all the listed 
applications. Users said Facebook.com was either the most frequently or second most 
frequently used service for looking for people they know (52%), reading contents 
provided by others (53%), finding information on events and products (36%), following 
brands and celebrities (39%) as well as for entertainment and their pastime ( 44%).228 


223 j- ] 

22^ [...] 

225 [...] 

226 [...] 

227 [...] 

228 j- j 






71 


Compared to other social media, a key element of Facebook.com usage is looking for 
people the users know. The fact that Facebook.com is used for a wider range of 
applications than other services shows that comprehensive social exchanges take 
place on Facebook.com. The comprehensive use of the personal “virtual space” is a 
testament to this. 

254 The survey also showed that the frequency of use is also an important element when 
it comes to determining the demand for a social network. The frequency of use varies 
considerably from one service to another: 84% of WhatsApp users use WhatsApp at 
least once per day, 65% of the Facebook users access Facebook.com every day, and 
40% of users of Instagram and Snapchat use these services at least once per day. In 
contrast to that, only 23% of the Google+ users, 19% of the Twitter users and 17% of 
the YouTube users said they used the service at least once per day. 

255 Those users who said they used individual services several times a day were asked for 
the average time they spend using these services per day. The answers users gave 
varied considerably. On the one hand, the reason for this could be that users find it 
difficult to estimate the average amount of time they spend using a network per day; 
on the other hand, their replies suggest that some users have understood the question 
to refer to their readiness to use the network. Some users, for example, said they used 
the service every day for 1440 minutes. The considerable variation in stated average 
daily usage duration makes the median^^® more meaningful than the mean value. 
Facebook.com’s median value is 50 minutes. The other services, in particular those 
which are used daily, have median values of 30 minutes (Google+, WhatsApp, 
Threema and Snapchat), or 15 minutes (Telegram and iMessage). 

256 In Facebook.com’s case, multiple daily access and the large amount of time spent on 
the network combined with the wide range of applications the network provides, support 
the social network’s function as a comprehensive personal “virtual space” for an in- 
depth social user experience. 

257 The market investigations have shown that this demand is reflected by the typical basic 
functions of a social network. It must be noted that there is no standard range of social 
network functionalities. Facebook’s view that the Bundeskartellamt had deduced a 
certain range of functionalities, in particular from the replies to the question referring to 
applications, is therefore inexplicable.^^^ A range of features and functions, however, 
can be regarded as characteristics of a social network, as they constitute the basis for 


229 The median is the vaiue at the centre of a iist of numeric vaiues sorted by vaiue. 
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the described comprehensive personal “virtual space”.Typically, these include the 
obligation to register, a detailed personal profile, a personal contact list, functionalities 
to find others (“friend finding”), communication options with other users and the 
customised presentation of contents in a newsfeed. The European Commission's 
market investigations in the “Microsoft/Linkedin” merger case had a similar outcome. 
Details of the case: 

258 To use a social network, its users must register by at least entering a user name and 
e-mail address or mobile phone number.^^^ Based on their registration, users can be 
found in the network and contact other users they know. 

259 Another typical characteristic of a social network is the possibility to set up a personal 
user profile.^^"^ Users can enter information on their places of residence, marital status, 
vocational qualification, occupation and hobbies, interests and political views. A user’s 
virtual identity is supposed to be a reflection of his/her real life, and thus to constitute 
an “online identity”. For this reason, the user’s true identity can often be deduced from 
his/her social network profile, which at least gives enough details for other users to 
imagine what the personality of the actual person behind the online profile is like. 

260 Users can develop a far-reaching personal network through social networks. A contact 
list is therefore a typical part of social networks. Users can connect with the listed 
members of the network community, e.g. friends, acquaintances and family, and 
manage and expand their contact lists. Most networks allow their users to control 
through privacy settings who can see what content of their profiles and who may 
contact them. They can adjust the social network to fit their own personal network and 
usage habits and to only include their specifically defined circle of friends and 
acquaintances.^^^ Social networks also offer “friend finding” functionalities to look for 
new contacts in the network. Most services offer extended search functions, filters or 
active “friend finding” functionalities. Users are suggested as contacts to other users 
who could know them or be interested in getting to know them.^^® 


231 [...] 

232 European Commission, COMP/M. 8124, “Microsoft/Linkedin”, decision of 6 December 2016, para. 98 In this 
investigation the market players stated that the following functions were vital for a social network: “creation of a 
user profile and the possibility to send/receive messages, closely followed by several others (searoh for other 
people in the network, send/accept invitations to connect with new contacts, post/share content, post comments 
on items posted by others, interact with other users through private or public groups and have a newsfeed 
displaying news from the user’s connections". 
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261 Typically, social networks have a newsfeed which filters the network content based on 

a user’s prior behaviour, displaying and ranking potentially relevant contents for each 
user.^^^ [.. [.. 

262 Further typical functionalities of social networks include various communication 
tools^'^'^ for sending or receiving contents or news to various groups of contacts. Users 
can communicate through texts or photos. Video and voice messages can also be 
exchanged through Facebook.com.A social network can also include chat or 
messenger functions for bilateral or group contact in real time. Other than 
communication options through posts or comments on Facebook pages, 
Facebook.com also offers Facebook Messenger, which can be used both as a part of 
Facebook.com and, separately, as a (especially mobile) application. Facebook 
Messenger can be used for sending messages and for making telephone and video 
calls. 

263 All in all the use of social networks does not depend on the terminal or operating 
system used. The user survey has shown that most users of online services use both 
desktop and mobile applications for these services, with an increasing tendency to use 
mobile apps.^'^^ There are other studies confirming this tendency towards mobile social 
media usage.^'^^ As most services are compatible with all operating systems, the type 
of operating system a user has (Windows, MacOS, Android, iOS, Blackberry or Linux) 
is not relevant in this context. This result matches with the Commission's decisional 
practice. It did not differentiate between the terminal devices or operating systems used 
in the “Facebook/WhatsApp” and “Microsoft/Linkedin” cases after having conducted its 
own market research.^'*'* 

(d) Services to be considered 

264 Besides Facebook.com, the only other services to be included in the market for social 
networks are StudiVZ and Jappy, as they offer similar functionalities and fulfil the same 
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2‘‘3 See for instance BITKOM study (in German), “Jung und vernetzt - Kinder und Jugendliche in der digitalen 
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purpose, albeit with limited scope for substitutability. Google+ used to be part of the 
market where the service was offered to private users (see i). Professional networks 
and career portals (Xing, Linkedin, Indeed, Stepstone - see ii) are not part of the market 
for private social networks. A separate market has to be defined for messaging services 
(SnapChat, WhatsApp, Telegram, Skype, Threema, FaceTime, WeChat, iMessage, 
Line, Viber, Yahoo Messenger, see iii). YouTube, Twitter, Pinterest (see iv.) and other 
social media (see v.) are not social networks. 

i. StudiVZ, Jappy and (formerly) Google+, 

265 StudiVZ, Jappy and, until its discontinuation, Google+ are the only services to be 
included in the market, with the possible exceptions of StayFriends and WizeLife. They 
offer(ed) typical social network functionalities. However, due to the direct network 
effects emanating from Facebook.com, their substitutability is limited. 

• Classification as social networks 

266 The Google+ service in particular could be classified as a social network. The version 
for private users served to find and connect with people the users knew and to 
exchange opinions, experiences and contents on a daily basis among groups defined 
and identified by each user. The company considered itself a social network and 
entered the market in 2010, opening its network to all users in 2011, to directly compete 
with Facebook.com. The network addressed private users wishing to participate in an 
extensive social exchange via a personalised virtual space. For this purpose, Google+ 
offered the corresponding core functionalities (see above, para. 258), which were to 
grant users an intensive social user experience. The Google+ business version, which 
is available for a fee as part of the “G-Suite”, however, is not part of the market, as it 
focuses on professional use (see ii below). 

267 The private user version of Google+ was not directly monetised through advertising or 
other sales. All users, including companies, could use the network for free. There was 
no direct advertising on Google+. Although the service was not directly linked to a 
market side subject to payment, it was to be classified as a market service pursuant to 
Section 18(2a) GWB. The service was linked to advertising-financed Google services, 
particularly the Google search engine. User data generated from the use of various 
Google services was accumulated and used for advertising purposes.Combined 
with the remaining Google services, particularly the search engine, Google-r served a 


see Google’s privacy policy, section “Why Google collects data”: “We may combine the information we coiiect 
among our services and across your devices for other Googie services.” This feature makes it easier to share 
things with peopie you know. Depending on your account settings, your activity on other sites and apps may 
be associated with your personal information in order to improve Google’s services and the ads delivered by 
Google.”, to be found on https://Dolicies.aooale.com/Drivacv (iast accessed on 10 January 2019). 




75 


common purpose to generate profiP® and thus constituted a market service pursuant 
to Section 18(2a) GWB. 

268 The ad-funded VZ services (StudiVZ and MeinVZ) (see above, para. 199) and Jappy 
(see above para. 187) are also classified as social networks and offer the typical 
functionalities. StayFriends (see above, para. 197) basically also serves to connect 
with people the users know, but the target group is considerably smaller. 

269 The platform serves to find friends from school and stay in touch with them. Users have 
to register naming the schools they went to and state their names at the time they 
studied there. However, the user survey has shown that StayFriends is used less 
intensively. In contrast to a large number of other services, 66% of StayFriends users 
log on to the service less than once per month, staying logged on for approx. 10 
minutes, which is a comparatively short period of use.^"^^ The network is thus unlikely 
to create a virtual social space, but rather a service offering occasional contact with 
former classmates and enabling personal contacts via the organisation of class 
reunions. In addition to that, only StayFriend’s very limited basic version is available 
free of charge. Its most important functions, including communication options, are only 
available to gold members, who pay an annual fee of €30.^"^® 

270 The user survey has shown that this “Freemium” business model does not generally 
exclude the network from the social network market. Users of private social networks 
tend to be unwilling to pay for the services. Most social networks are thus free of charge 
for their users and mostly funded through advertising.According to the user survey, 
84% of the respondents^^° currently do not use a service that has to be paid for.^®^ 
Some users said they were willing to pay for additional services like premium functions 
or an advertising-free service.It could therefore be considered to include 
StayFriends in the list of possible substitutes as it offers an advertising-free service for 
a small annual fee.^^^ However, the percentage of StayFriends users who are gold 
members, which is the prerequisite for using all functions, is comparatively low. For this 
reason, the service is not a substitute for advertising-financed social networks like 
Facebook.com, Google-i- or Jappy. This question, however, can ultimately be left open. 


For more information, please refer to the Bundeskartellamt’s Working paper "Market Power of Platforms and 
Networks” of June 2016, p. 36; Government reasoning to 9th amendment to the German Competition Act, 
Bundestag printed paper 18/10207, p. 48. 
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The same applies to the “Odnoklassniki” service, which offers all the functions of a 
social network, albeit not in German. 

271 The Wize.Life service (see para. 207 above) also has typical social network 
functionalities. However, the service also addresses the small “best ager” target group 
aged 40 or older and emphasises the option to meet like-minded people on the 
platform, both online and in person.^®"* Due to its focus on older users, Wize.Life does 
not consider itself a competitor of Facebook.com, but rather of www.feierabend.de or 
www.platinnetz.de, which also address senior citizens.Its users also do not log on 
frequently enough for the network to be a substitute for the social user experience 
offered by other social networks. Ultimately, this question can be left open. 

• Direct network effects limit substitutability 

272 Despite the fact that the products Facebook.com and (until recently) Google-i-, StudiVZ, 
Jappy and other services are basically similar, their substitutability is limited due to the 
direct network effects existing with Facebook.com. As was outlined above (see para. 
217), there are positive direct network effects among private users of Facebook.com, 
as users of this group directly benefit from more members of their own user group being 
on Facebook.com. 

273 The connection between the users that leads to the network effects can be either direct 
or indirect. Social networks are mainly characterised by direct network effects 
developing between their members. They primarily serve to connect friends and 
acquaintances and to enable communication between them. The more private users 
are active on Facebook.com, the higher the benefits for everyone in this user group as 
the options for users to interact and find friends and acquaintances increase with an 
increasing number of users in the social network. The network effects are “identity- 
based” because the users’ identity rather than just the number of users is relevant in 
this context. Individual consumers practically only benefit from the virtual social 
community rather than the functionalities of the social network. The network’s value for 
individual consumers increases with an increasing number of people from their social 
context who join the network. 

274 A social network’s size is thus a key criterion for the substitutability of services from the 
customers’ perspective. When it comes to identity-based network effects, it is 
particularly important that users find exactly the people they are looking for in the 


The same applies to the services provided by “Platinnetz” and “Feierabend” (both services belong to Feierabend 
Online Dienste fur Senioren AG based in Frankfurt am Main and have a maximum of [...] members), which, like 
Wize.Life, are often perceived as dating piatforms as they offer peopie to meet each other. 
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network. The user survey has also shown that the decisive criterion for users is whether 
their friends use the network too. Approx. 85% of the respondents said they found it at 
least important that their friends also use the network.^^^ 75% of the Facebook users 
would thus make more use of a service other than Facebook.com if their friends were 
using that service.Some companies emphasise that the likelihood of finding friends 
and acquaintances on a network increases proportionally to the network’s absolute 
size.^^® According to them, all companies aimed at expanding their networks to an 
extent that allows users to find and contact the “right people” there.Another factor of 
interest, according to the companies, was the members’ activity on the network, i.e. the 
intensity with which they use the network and the quality of the contents provided. 
The quality of the contents provided depended on the network’s data width and depth 
in terms of personal data and data on user interests and behaviour.^®^ The network’s 
size and intensity of use are two mutually reinforcing factors.^®® 

275 With users selecting a network based on information from public sources, there is 
reason to doubt that they would replace Facebook with smaller networks like StudiVZ 
or Jappy in view of Facebook.corn’s absolute user numbers in Germany, which have 
been publicly communicated^®”^. Facebook.com has 23 million daily active users, 
whereas less than a million users are reg/sferecf with StudiVZ (2016) and Jappy. The 
number of daily active users for the latter is even lower, i.e. these networks are merely 
a supplement to other social networks.^®® 

276 The substitutability of Google+ under this aspect was limited, too. While the user 
numbers of Google+ were larger than those of its German competitors, they still did not 
come near the user numbers achieved by Facebook.com.^®® However, Google+ had 
an absolute size for a while that made it likely for friends and acquaintances to find 
each other there. Users ultimately select the network on which they actually find their 
friends for their daily activities, as was shown by the user survey. Connections to friends 
on Facebook.com cause a strong lock-in effect, which makes it difficult to switch 
networks, as friends (and friends of friends, etc.) would have to be convinced to switch 
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networks, too. As a consequence, even a “market for Facebook” (single-platform 
market) can be considered. However, the outcome of this consideration can be left 
open as Google-i- has left the market and the competitive assessment will not change, 
even if other services are considered as well. 

ii. Professional networks like Linkedin, Xing, Indeed are no substitutes 

277 Professional networks like Linkedin and Xing, or job search portals like Indeed^®^ or 
Stepstone are not part of the private social network market.^®® While, like private social 
networks, they serve for developing personal networks, these networks focus on 
professional contacts, which is why, in terms of their purpose of use and their 
functionalities, they are not interchangeable with private social networks. Also, their 
users are more willing to pay for the service provided, as professional networks are 
often designed as “freemium” services where essential functionalities are subject to 
relatively high fees. 

278 Professional networks are mostly used for networking purposes in the professional 
context.^®® While private networking mostly serves to keep in touch with personal 
contacts, professional networks are mainly used for fostering the users’ careers. The 
European Commission has reached the same conclusion in its market investigations 
in the context of the “Microsoft/Linkedln” merger proceeding. The market players 
questioned said they used professional social networks for other applications than 
private social networks. The focus of their user profiles was on professional networking, 
and in some cases it was mandatory for users to include their key career steps. The 
Commission’s decision in particular refers to a Linkedin study (“The Mindset Divide”) 
investigating the different motivations for using a private or professional network. While 
users wanted to “socialize, stay in touch, be entertained, kill time, share content’ with 
private social networks, their aim was to “maintain professional identity, make useful 
contacts, search for opportunities, stay in touch, keep up to date for careef with 
professional networks. 

279 The market participants have confirmed this point of view in the current proceedings. 
Xing said private and professional networks were “separating”. Whereas Facebook had 
clearly positioned itself as a network for private users (contacts = friends, holiday 


https://www.indeed.com/ (last accessed on 10 January 2019), [...] 

2®® Cf. European Commission, COMP/M. 8124, “Microsoft/Linkedln", decision of 6 December 2016, para. 115ff. 
[...] 

European Commission, COMP/M. 8124, “Microsoft/Linkedln”, decision of 6 December 2016, para. 109 with 
reference to https://business.linkedin.com/content/dam/business/marketina- 

solutions/global/en US/site/odf/wp/linkedin-marketina-solutions-mindset-divide.pdf (last accessed on 10 
January 2018), [...] 
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pictures, primarily private messages and groups), Xing had always focused on its 
function as a professional network, with its target group being professionals.The 
user survey confirms this finding as it has shown that Facebook.com is used for 
professional purposes to a limited extent only. Only 6% of Facebook’s users said they 
used Facebook.com (also) for professional purposes. Facebook.corn’s attempt to 
attract professional users by offering a job seeker function^^^ does not mean that all 
professional networks have to be included in its market. 

280 In terms of their functionalities, professional networks have been designed for 
professional networking. Besides general functions which are also offered by private 
social networks, they offer targeted functions for professional purposes like a detailed 
job search function, a job portal and recommendations for new professional contacts.^^^ 
Users of professional networks also post different contents and connect with different 
people. They are more cautious about posting “private” content like family pictures, 
holiday posts, political views, etc. and instead select content of interest for (potential) 
employers, head hunters and colleagues.^^'^ 

281 In addition, the user fees are comparatively high, especially on Xing and Linkedin, 
which also decreases the likelihood of substitution. While private networks offer their 
services for free, or, like StayFriends, for a small fee, Xing’s and Linkedin’s business 
model offers key functions only for paying members. Targeted search and connection 
with other users for professional purposes is only available to these members. 

282 Xing for instance offers its premium membership for EUR 7.95 per month (or EUR 9.95 
for three months) and an additional “ProJobs” membership for EUR 24.95 to EUR 38.95 
per month, depending on the duration. Xing’s basic membership offers only limited 
functionalities and no communication options, i.e. the key network functions are only 
available for a fee.^^® Linkedin also offers various premium packages for a monthly fee. 
Besides a simple premium membership, the price of which is similar to Xing, a “job 
seeker” membership is available for EUR 26.17 per month, a “business plus” 
membership for better professional networking for 41.64 per month, and a corporate 
membership for finding qualified staff (“recruiter lite”) for EUR 89.19 per month. The 
free basic membership offers some communication options. 


272 [...] 

273 Outcome of the European Commission's market investigations, COMP/M. 8124, “Microsoft/Linkedln", decision 
of 6 December 2016, para. 101. 

27“* European Commission, COMP/M. 8124, “Microsoft/Linkedln”, decision of 6 December 2016, para. 104-106. 
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283 The Stepstone job portal also offers the possibility to post job adverts or search them 
for a fee. Besides, based on their functions such job portals are not to be considered 
as a social network, but rather as a brokering platform for employers and job seekers 
which is paid for by one side of the market. The job portal Indeed also requires 
employers to pay for job adverts. 

284 Where professional networks and Facebook.com are used in parallel, this does not 
indicate substitutability and the existence of a uniform market. In particular, this does 
not represent a parallel use of several services which limits market power pursuant to 
Section 18(3a) no. 2 GWB. The underlying assumption of Section 18(3a) GWB was 
developed by Evans/Schmalensee^^^. It holds that multi-homing has a limiting effect on 
concentration on platform and network markets. However, this can only apply if users 
use several platforms and networks in parallel to satisfy the same requirements, i.e. 
services of the same markets.Multi-homing itself is not an indication of uniform 
requirements. Parallel use of various differentiated platforms can, by contrast, be an 
expression of the fact that the platforms fulfil different requirements from the user’s 
perspective, so that the different offers are imperfect substitutes to one another.^^® 

285 In this case, market investigations have shown that professional and private networks 
are used for different applications and are therefore no functional substitutes for one 
another. 

iii. Messaging services excluded 

286 According to the investigations, the services WhatsApp, Google Hangouts, Snapchat, 
Telegram, Threema, iMessage, Skype, FaceTime, Line, WeChat and Viber and the 
Facebook Messenger app, which is used separately, cannot be attributed to the social 
network market, as they serve to fulfil complementary requirements from the users’ 
perspective. However, this does not rule out the possibility that substitute competition 
emanates from these services on Facebook.com, including the corporate service 
WhatsApp. 

287 These services are classified as messaging services, which are not substitutable for 
social networks based on their applications and characteristics. The investigations 
have shown that these services are mostly used in addition to social networks to 
complement their range of services. While messaging services, like social networks, 
serve to communicate with friends and acquaintances, messaging services do not 


See outline of the Status of discussion at the Bundeskartellamt, Working paper "Market Power of Platforms and 
Networks”, June 2016, p. 57ff. 

2^® Bundeskartellamt, Working paper "Market Power of Platforms and Networks", June 2016 , p. 62 
Bundeskartellamt, Working paper "Market Power of Platforms and Networks", June 2016 , p. 61 
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allow the creation of a virtual social space in which users have an intensive social 
experience by being able to exchange opinions, experiences and messages. Their 
functionalities and use also differ accordingly. 

288 Services like WhatsApp, Snapchat, Telegram, Google Hangouts, Threema, Skype, etc. 
are often summarised as “Messaging” or “Instant Messaging” services. In its 
decision on Facebook/WhatsApp, the European Commission refers to these and other 
services by using the general term “consumer communication services”^®®, which to a 
certain extent associates them with telecommunications services like SMS (Short 
Message Services) or e-mail. 

289 “Instant Messaging” refers to real-time text message chats between two or more 
participants which comprise photo, video or audio files. The messaging services also 
offer voice and video messaging options and each have a different focus regarding to 
the functionalities they offer. Skype for example is particularly known for its video chat 
(“Skype”) function, but it also offers all other chat functionalities. From a technological 
point of view, these services are based on the “push messaging procedure”, which 
directly sends (“pushes”) the messages to the recipient’s device. The services use a 
network protocol which facilitates an exchange of data between computers. Like 
WhatsApp and Skype, many services use a proprietary protocol. Users connect with 
each other through a computer program or an app (client) via a network, which is 
normally the internet. 

290 Messaging services are primarily used for rapid communication. They serve for point- 
to-point bilateral or group communication. Groups are set up and managed by an 
administrator. The content of such communications quickly loses its relevance as the 
communication takes place in real time and is thus not normally saved. For this reason, 
the services put their emphasis on functionalities facilitating communication between 
two people or small groups.^®^ When registering with the service, users grant the 
application access to the list of mobile phone numbers saved on their smartphones, 
which it uses to set up a list of contacts that normally includes the users’ principal 
contacts. Users generally cannot add new contacts unless they know their mobile 
phone numbers. There is no option to set up a detailed user profile including personal 
data like date of birth, marital status, occupation and hobbies, so there is no “online 
identity”.^^^ Users also cannot comment or rate the contents posted by others as part 
of a bigger community or post contents themselves.There is no newsfeed, and users 


European Commission, “Facebook/WhatsApp", decision of 3 October 2014, COMP/M. 7217, para. 13 ft. 

[...] 

282 j- j 

283 j- j 



82 


cannot see other people’s networks by checking their lists of friends, as the list of 
contacts can normally only be viewed by the user it belongs to. 

291 As a result, messaging services lack the comprehensive user experience as facilitated 
by social networks with regard to their application and relating characteristics. Skype 
and Yahoo Messenger do not consider themselves social networks.In its notification 
for the Facebook/WhatsApp procedure with the European Commission, Facebook 
pointed to this difference itself.^®® Facebook upholds the view in the present proceeding 
that users consider WhatsApp the key service for quick, personal and direct 
communication with friends and family {“WhatsApp in many way was considered the 
de facto way to communicate"), whereas Facebook.com to them is a service for 
obtaining information about friends, companies and other contents.^®® The user survey 
conducted in the context of this procedure confirms this result. It showed that there is 
a strong focus on messaging (76%) and contacts to friends (69%), in particular when it 
comes to WhatsApp.^®^ [...] Snapchat studies also see only partial overlaps.^®® 

292 As is the case with professional networks, a parallel use of social networks and 
messaging services does not rule out the existence of a uniform market. For the 
purposes of the market definition, nothing can be deduced from a parallel use as such. 
Social networks and messaging services complement each other with their different 
applications, even though they both aim at communication with friends. The fact that 
Facebook.com offers Facebook Messenger, and Google+ offered Google Hangouts in 
addition to the communication options of their social networks also suggests that the 
services are used as complements to one another. 

293 By defining separate applications for messaging services and social networks, one 
does not rule out the possibility of substitute competition between the services when it 
comes to some of their functions. However, direct network effects act as a limiting factor 
of competition, as is outlined above for social networks. Instead of suggesting that 
messaging services are similar products to social networks, the fact that messaging 
services also develop direct network effects further limits the range of potential 
(substitution) competitors. Messaging services are also marked by identity-based direct 
network effects, as their purpose is direct communication with specified friends and 
acquaintances who have to use the same messenger service as there is no 
compatibility or interconnectivity of the services. For this reason, a service’s 
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attractiveness is higher if it has a large number of users. The user survey for example 
shows that this applies to the services named above too, of which WhatsApp has the 
largest number of users. 

294 Parallel use of the services cannot reduce the direct network effects existing for each 
of the services unless exactly the same users stay in touch with the same circles of 
friends who have the same contacts on the services. Substitute competition can be 
assumed to increase with increasing overlaps between the circles of users. In this 
regard, substitute competition could merely be assumed to exist between Facebook 
and its WhatsApp service However, the figures on parallel use do not prove that 
the lists of friends and contacts are identical in both services. 

iv. Snapchat excluded 

295 Contrary to Facebook’s view^®°, the Snapchat service in particular cannot be 
considered a direct competitor. The service cannot be considered a social network 
despite the fact that it has further developed its functionalities. This service in particular 
cannot be included under the aspect of its supply-side substitution, either. 

296 The Decision Division holds that Facebook is incorrect in claiming that Snapchat is to 
be considered a social network.^®^ While Snapchat differs from other messaging 
services in certain aspects, it does not compare to a social network as a comprehensive 
personal virtual space.^®^ 

297 Snapchat’s key function is its smartphone camera which opens automatically once the 
user starts the app. The user is thus motivated to become active immediately by 
creating and sharing with his friends and family so-called “snaps”, which are mostly 
photos or videos creatively enhanced through lenses or filters. Snaps are automatically 
deleted a short while after being viewed and are thus ephemeral. Besides ephemeral 
“snaps”, users can create “stories” which consist of a sequence of snaps (photos, 
videos). A user’s own contacts can see these stories by default. They will be available 
for 24 hours before being deleted automatically. However, users can save them as 
“memories” before they are deleted. Commercial users can use Snapchat as a platform 
for their own “channels” to spread their editorial content via the “discover” function. 
Users can view and follow these channels. Snapchat also has a function permitting 
users to find friends whose mobile phone number is unknown to them via a Snapchat 
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code (see above, para.196). Real names are not required on Snapchat. Users can 
enter a user name and a “bitmoji” profile picture. Bitmoji is a functionality that has been 
included in Snapchat since 2016^®'^. It allows users to create personalised “avatars” 
(non-identifiable picture of a person). Snapchat does not provide its users with the 
possibility to enter a differentiated profile containing information about their relationship 
status, occupation, place of residence or interests.^^® 

298 It cannot be assumed that Snapchat could substitute the social network Facebook.com, 

even though it has functionalities which come closer to those of social networks. 
However, the described functions do not provide for a virtual space allowing a 
comprehensive social user experience using an online identity. The country manager 
of Snapchat Germany, Marianne Bullwinkel, thus rightly considers Snapchat “a camera 
app facilitating a particularly creative way of communicating with friends and family” 
rather than as “social media”.Snapchat’s competitors are Facebook’s services 
WhatsApp and particularly Instagram rather than Facebook.com. Instagram is 

particularly successful [...] and attacks Snapchat’s position.There is, however, no 
similarly successful competition to Facebook.corn’s social network. While Facebook 
states that the “Stories” function was launched for Facebook.com in 2017, Snapchat’s 
reaction refers to Instagram In addition, German users have been reluctant to 

use these functionalities so far. The actual focus of Snapchat users continues to be on 
sharing pictures with integrated filters.^°° 

299 Snapchat cannot be included in the social network market with a view to its supply-side 
substitution either [...f°T 

300 Pursuant to the Federal Court of Justice’s case-law, the definition of the relevant market 
generally also include products which are no functional substitutes for those on the 
market in question, but which form the basis for manufacturers to offer a competitor 
product if the competitive conditions in the market allow for it. Supply-side substitution. 


29'* Bitmoji is a separate mobile app by Bitstrip Inc., a subsidiary of Snapchat, available since 2016. 

295 [...] 

296 http://www.horlzont.net/tech/nachrlchten/Marlanne-Bullwinkel-So-snaDDen-dle-Deutschen-161163 (in German, 
last accessed on 10 January 2019). 

297 Comparison of “Snapchat Stories" with “Instagram Stories" available (in German) at 
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298 Snap, B6-22/16, competitor survey, p. 3149 of the file, cf. 
https://www.baslcthlnkinq.de/bloq/2017/06/21/whatsapp-snapchat-storles/ (in German, last accessed on 10 
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however, can only be assumed to exist if the providers of similar products are willing 
and able to modify their offer at short notice and at reasonable economic cost.^°^ Unless 
these preconditions are met, it cannot be assumed that the competitive pressure 
currently existing is sufficient to influence the conduct of companies active on the 
market in a way that would justify treating providers of similar products like current 
competitors.^”^ Unlike potential competition, which is assessed on the basis of the 
likelihood and possibility of entering the market in the medium term””'*, the relevant 
criteria for defining the market are that other companies can switch their supply at short 
notice and low cost. Treating companies which are active on similar markets as current 
competitors is therefore only justified if they can switch their supply immediately at no 
significant additional cost. Such companies cannot be considered competitors if their 
change of supply would entail considerable adjustments of existing tangible and 
intangible assets, additional investments, strategic decisions or delays. This view 
corresponds to the European Commission's guidelines for market definition.””” 

301 It has to be considered, in addition, that the market has to be defined for abuse control 
purposes. Unlike merger control, abuse control assesses current, immediate or past 
market behaviour towards individual market players rather than the future market 
structure. Pursuant to the Federal Court of Justice’s case-law, each individual case 
must be carefully examined when applying abuse control of powerful or dominant 
market positions with regard to whether the addressees’ current competitive behaviour 
at the time of assessment is controlled by competitors’ general supply-side 
substitution.””” 

302 On this basis, Snapchat is not included in this case. Leaving technological aspects and 
the required investments aside, which could make supply-side substitution at short 
notice difficult, there is also reason to doubt that Snapchat would be willing and able to 
change its product and company philosophy to turn itself into a social network offering 
a user experience similar to Facebook.com. Snapchat’s service became successful 
because it offered ephemeral snaps which were deleted by default after a short while. 
Snapchat founder Evan Spiegel said that Snapchat was all about “showing who I am 


Federal Ceurt ef Justice, decision of 16 January 2007, ref. KVR 12/06 , BGHZ 170, 299-311 - National 
Geographic II, para. 20 (juris). 
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law, OJ of 9 December 1997, C 372/5, para. 20, 22, 23. 

Federal Court of Justice, judgement of 24 January 2017, ref. KZR 47/14, “VBL Gegenwert ll“, para. 25. 



86 


now”.^°^ The fact that the snaps are ephemeral lowers users’ inhibitions to share 
unfavourable photos of themselves. According to Snapchat, it is part of the company’s 
philosophy to facilitate real time communication which is as realistic as possible. The 
company holds that real-life conversations are also ephemeral, which would lead to 
more casual behaviour than in recorded conversations.^®® With its short-lived contents, 
Snapchat is particularly popular among young users.®®® 

303 In contrast to that, a social network requires long-term user relationships rather than 
short-lived posts. Long-standing active users use their social network like a diary. They 
save photos and contents permanently and can display them in chronological order if 
they wish, which is supported by the fact that Facebook.corn’s newsfeed displays both 
current and selected past posts (“rediscover shared contents and posts”). Not even 
Snapchat’s new functions “Snapchat Memories” or “Snapchat Stories” are aimed at 
providing users with a similar kind of experience. Like snaps, Snapchat stories are 
“ephemeral” and disappear 24 hours after publication. Snap Inc. deliberately focuses 
its service on its users’ “closest” friends and thus, according to its own statements, does 
not plan on expanding its network functions to “friends of friends” or “social hooks” like 
“Like” buttons. The service is to focus on active communication with the users’ “real” 
friends.®^® That being said, it is not to be expected that Snapchat will simply modify its 
service and add further functions to turn it into a social network that is used in a 
completely different way. As outlined above, the service is rather a competitor of 
WhatsApp and Instagram. 

304 Contrary to Facebook’s view, a “critical mass” of users or technological, financial or 
personal skills are not an indication of supply-side substitution. It cannot generally be 
assumed that large platforms and services are capable any time of entering closely 
related markets and being as successful as on the first market, making them current 
competitors in various internet-related markets. Conversely, the services’ scope cannot 
be “transferred” to other services. While it may be technically feasible to switch or 
expand to another product, the service starts from scratch in terms of the “critical mass”, 
as was illustrated by the example of Google-i-. This is especially true for products 
completely changing their underlying philosophy, as would be the case here.®^^ In 
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addition, this also applies in particular with regard to the strong direct network effects 
which keep users with Facebook.com and WhatsApp and which form a considerable 
barrier to market entry, as a newly formed service would have to convince current 
Facebook users to switch. Facebook had developed the “Poke” app [...], which served 
to share contents that disappeared within seconds after being read. Poke [...] 
discontinued in 2014.^^^ According to Facebook, the company has unsuccessfully tried 
to compete in further markets, but discontinued these efforts^^^, which shows that not 
even Facebook can transfer its user base to another closely related network market. 

305 Facebook gave a few examples of successful developments by other services, namely 
of photo service Flickr successfully developing an online game, or gaming platform 
Slack successfully developing communication software and YouTube successfully 
developing a video dating platform. However, none of these examples are relevant in 
the context of social networks.^^"^ In individual cases, a good service can quickly 
become successful, which is a characteristic feature of internet dynamics. However, 
internet dynamics and innovative power as such cannot be used to justify supply-side 
substitution, which can actually be limited in individual cases. This applies in particular 
to the lock-in effect on the targeted user group due to direct network effects (see also 
460ff.). There is reason to doubt that Snapchat already has a “critical mass” of users in 
Germany, which would enable the company to switch its offer towards a social network. 
According to press information, approx. 5 million users in Germany use Snapchat (June 
2017). The number of daily active Facebook users is considerably higher and 
amounted to approx. 23 million in 2017.^^® 5% of the users questioned during the user 
survey commissioned by the Bundeskartellamt said they use Snapchat on a regular 
basis. 

306 It can ultimately be left open whether Snapchat is to be included in the market, as the 
competitive assessment would not change as a result. However, to be consistent, the 
Facebook services Instagram and WhatsApp would have to be included as well. These 
have considerably larger user numbers than Snapchat. Contrary to Facebook’s^^® view, 
the fact that the European Commission classified WhatsApp as a messaging service 
in 2014 does not substantiate the view that Snapchat and WhatsApp belong to separate 
markets. Like the Bundeskartellamt, the Commission distinguished between social 
networks and messaging services based on the comprehensive social user experience. 
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real-time communication and social functionalities in a larger user group.^^^ These 
differences continue to apply to Snapchat despite the additional functionalities, which 
is why the Bundeskartellamt holds that the service is a photo-based messenger service 
like WhatsApp. 

V. YouTube, Twitter 

307 Contrary to Facebook’s view^^®, YouTube and Twitter are not part of the social network 
market, either. 

308 While there are some overlaps with Facebook.com when it comes to functionalities, 
there are major differences with regard to the purposes for which the services are used, 
the providers’ positioning and the functionalities offered to this end, which contradict 
substitutability with Facebook.com from the users’ perspective. 

• YouTube 

309 Contrary to Facebook’s view^^®, this primarily applies to the YouTube service, which is 
first and foremost a video platform for watching and exchanging videos. YouTube 
considers itself primarily a “video-on-demand” platform which offers some “social” 
functions, as users can watch, rate and share videos.^^° The strategic orientation of 
video platforms like YouTube is completely different from social networks which 
emphasise interactive communication between users in a virtual social space. Only 4% 
of the users questioned counted YouTube among the services they use as “social 
networks”, also 79% of them actually use YouTube. 

310 The fact that the exchange of videos and the communication processes take place 
between two separate user groups rather than within each user group shows 
YouTube’s strategic orientation as a video platform. The focus is on its platform 
characteristics, which enable direct interaction between the users uploading the videos 
(the “creators”) and the users who watch the videos. Users can subscribe to the 
creators’ “channels”. The service is mainly characterised by the indirect network effects 
which exist between these user groups. YouTube has turned into a marketing platform 
for artists which generates its own stars. Artists post their videos, which in turn generate 
considerable advertising revenue. A central element of YouTube’s business model is 
to have the largest possible number of “creators” on the platform. YouTube offers 
special partnership models to support particularly successful “creators” for this 
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purpose.^^^ Besides, YouTube has a special incentive structure which also attracts 
private users. Unlike social networks for private networking with friends, they can 
potentially generate significant advertising revenue with their own videos on YouTube. 

311 On YouTube, communication between the channel subscribers is limited to public 
comments to which everyone can post a public reply. Until August 2017, however, 
sharing videos on YouTube was not possible. Users had to share them via e-mail or 
interfaces with other services like Facebook.com and WhatsApp before that date. In 
August 2017 YouTube launched its own messaging service and integrated it into the 
mobile YouTube smartphone app which facilitates sharing and chatting about videos 
with contacts from the users’ contact lists, either bilaterally or in groups. This app was 
created to modernise the process of sharing YouTube contents. Users can now share 
videos directly with their friends while continuing to watch, browse, discover new 
contents or add their own videos. A desktop version of the app was launched in June 
2018.^^^ However, this chat function does not make the platform part of the social 
network market. Instead, it gives access to the messaging services market. As outlined 
above, the fact that some social network providers also offer messaging services, e.g. 
the Facebook Messenger, WhatsApp or Google Hangouts, does not make these 
services substitutes of social networks. 

312 Based on the indicated applications, the user survey has shown that YouTube thus 
does not work like a virtual social space digitally reflecting the user’s social 
relationships. Many users mostly use YouTube for “entertainment and pastime”. 
YouTube is hardly ever used for other purposes (e.g. contacts to friends, messaging, 
looking for people the user knows, share contents) [...]^^^ All in all, this shows that 
YouTube is an imperfect substitute for Facebook.com. YouTube primarily serves to find 
relevant contents and entertainment, while entertainment only accounts for a small 
fraction of the applications for which Facebook.com is used. 

313 The time spent on YouTube compared to Facebook.com confirms this statement: 
Providing a virtual social space, Facebook.corn’s daily usage is high, while YouTube is 
used less often. Users gave the following information on their usage times in the survey: 
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YouTube 

Facebook 

Is used 


79% 

58% 


of which: 

more than once per day 

10% 


49% 


once per day 

8% 


16% 


several times a week 

23% 


11% 


once a week 

12% 


6% 


several times a month 

16% 


5% 


approx, once a month 

15% 


6% 


less often than that 

17% 


8% 


314 Viewing YouTube videos is normally not subject to registration. A significant number of 
daily active YouTube users use the service without registration, which means that they 
can view all the videos, but cannot use any further functionalities.^^® This also 
demonstrates that the passive consumption of videos clearly takes priority. YouTube 
refers to its users as “viewers” and registers usage figures classified according to the 
categories “daily active viewers” (DAV) and “monthly active viewers” (MAV). 
Consequently, videos are the only type of media which can be uploaded. YouTube has 
no upload functions for audio files or photos. Upon registration, users can start their 
own YouTube channel, including a channel icon, and enter a detailed channel 
description under “About”. However, there are normally no detailed user profiles. 

315 The assessment that YouTube is not a social network®^^ is not changed by the fact 
Facebook.com launched the “Facebook Watch” (US only) and “Facebook for Creators” 
functions in 2017, which have certain overlaps with YouTube’s business model. 
Video functionalities only account for a fraction of Facebook.corn’s overall network 
functions as part of a comprehensive user experience, i.e. an offer of video contents. 
Facebook.com’s entering the video platform market does not make YouTube a part of 
the social network market. 

316 Neither can YouTube be included in the market in view of possible supply-side 
substitution. The arguments on Snapchat (para. 295ff) apply. In addition, it cannot be 


326 [...] 

327 [...] 

328 j- ] 
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expected that YouTube will be successful on the social network market in the short 
term with reasonable economic effort, as it developed its large user basis with a 
completely different underlying philosophy. Google’s own company history has shown 
this: In 2013, Google tried to link the use of YouTube to the use of its social network 
Google+. A Google+ registration including a user profile was required for posting 
comments on YouTube. YouTube users massively protested against this.^^^ In autumn 
2015, Google reversed the practice.^^° 

317 It also has to be considered that Google already had its own social network, Google+, 
which was set up to compete with Facebook.com but failed. As stated above, Google 
now operates Google+ as a business product only. It is not evident that Google could 
intend to develop YouTube into a second social network, which would potentially put 
YouTube’s recipe for success as a video platform at risk. As described in para. 276, 
the problem of direct network effects has to be taken into account. YouTube rather 
pursues the audio-visual development of its platform and now offers subscription 
models subject to fees. In June 2018, YouTube launched its music streaming service 
“YouTubeMusic” in Germany.There are two options to use the service: either for 
free with advertising or as a premium service for a monthly fee of 9.99 euros. At the 
same time, “YouTube Premium”, an advertising-free premium version of YouTube that 
had already been available in the US, was launched in Germany for a monthly fee of 
11.99 euros.With this strategy, YouTube moves even further away from social 
networks. 

318 Contrary to Facebook’s view, parallel use (multi-homing) of Facebook.com and 

YouTube does not support the argument of a single product market. [...]^^^[...]^^'‘ [...] 
Facebook.com and YouTube are increasingly used in parallel, That being said, 

the parallel use does not take place for direct communication processes with friends 
and acquaintances. As stated earlier, a large number of “DAVs” uses YouTube without 
registration and thus solely for viewing videos. 


httDs://voutube.aooalebloa.com/2015/07/voutube-comments.html (in German, last accessed on 10 January 
2019), [...] 

f...1 https://qooqlebloq.bloqspot.de/2015/07/evervthinq-in-its-riqht-place.html (last accessed on 10 January 
2019), [...] 

Cf. https://www.heise.de/newsticker/meldunq/Musik-Streaminq-YouTube-Music-startet- in-Deutschland- 

4084187.html (available in German only, last accessed on 10 January 2019). 

Cf. https://www.heise.de/newsticker/meldunq/Gooqle-startet-Streaminq-Dienst-YouTube-Music-4050846.html 

(available in German only, last accessed on 10 January 2019). 
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• Twitter 

319 From the users’ perspective and based on the application and form of use, the Twitter 
service is not part of the market for social networks, but can at most be considered as 
substitute competition. 

320 While Twitter users can set up a detailed profile stating their age, sex, occupation and 
general interests^^®, and also check their contact list against the service to see which 
of their contacts are active there®®^, they cannot develop an online identity or connect 
with friends or people they know to exchange experiences, opinions and contents 
among a group of people defined by themselves. 

321 Twitter is often categorised as a so-called “microblogging” (short message) service. A 
“blog” is a journal which is typically kept on a website and normally publicly accessible. 
A person referred to as “blogger” uses the blog as a log or enters contents such as 
photos or videos, or simply makes notes of his/her thoughts. “Microblogging” means 
blogging by posting short status messages which typically do not exceed a length of 
200 characters. As described above (see para. 203), registered users can use Twitter 
to share short, telegram-style messages (“tweets”) not exceeding a length of 280 
characters (excluding attached files or quoted tweets). The service thus has similar 
functions as a messaging service due to the real-time tweets and its overall quickness 
of response. [...] Twitter focuses on real-time information on current developments 

j- j338 

322 Unlike social networks, the service is also characterised by highly visible public tweets. 

Tweets are public by default. While users can also decide to share their information 
bilaterally or in a small group of users, the service considers itself primarily a platform 
for public self-promotion and real-time exchange Twitter emphasises that, in 

contrast to the service provided by its competitors, users can also see tweets from 
users they do not know.®”^® A key feature of Twitter is the hashtag (#) which serves to 
find public tweets. Frequently used hashtags are potential “trending topics” in public 
debate. 

323 Another area of focus of this service is content sharing.®"*^ As detailed above, the 
“content-sharing services” category is often found among the various social media 


336 |- ] 

Twitter, https://twitter.com/who to follow/import (last accessed on 27 July 2018); similar procedure with the 
services Weheartit and Instagram. 

338 |- j 

339 |- ] 
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definitions.^'^^ Internet platforms are focused on the publication of contents and 
interactions between users and contents.The (smaller) group of “creators” is 
normally confronted with a larger user group which consumes and comments on the 
contents published by the creators. However, content-sharing platforms lack social 
functions exceeding the scope of comments/likes.On Twitter, users who do not know 
each other frequently exchange opinions and contents. The users’ identity does not 
matter to the same extent as it does on social networks. The volume and relevance of 
the contents posted on the platform are the important criterion. 

324 As a content platform, Twitter is thus comparable to YouTube, which is also often 
classified as “content-sharing” platform. As on YouTube, users can look at contents 
without registration on Twitter.^'^® Users only have to register if they want to interact with 
other users, e.g. to comment on certain contents or to “follow” them. 

325 Twitter also cannot be classified as a social network on the basis of the time spent on 
the service: 




YouTube 

Facebook 

Twitter 

Is used 


79% 

58% 

15% 


of which: 

more than once per day 

10% 

49% 


12% 


once per day 

8% 

16% 


6% 


several times a week 

23% 

11% 


15% 


once a week 

12% 

6% 


10% 


several times a month 

16% 

5% 


9% 


approx, once a month 

15% 

6% 


18% 


less often than that 

17% 

8% 


31% 


326 The users’ replies show that Twitter is used in a way that rather compares to YouTube, 
although it has considerably fewer users who more frequently said they would rarely 
use the service. This is another aspect under which this service cannot be considered 


See for example the definition by the German Association for the Digital Economy (BVDW), 
https://www.bvdw.ora/fileadmin/bvdw/upload/publikationen/social media/Komoass Social Media 2016 2017. 

pdf (in German, last accessed on 10 January 2018): Content-sharing services allow users to share content, 
e.g. photos, videos or music, with other users, who can rate, recommend or link it. 

- [...] 

344 [...] 

345 [...] 

346 www.twitter.de (in German, last accessed on 10 January 2019),[...]; www.voutube.de (in German, last accessed 
on 10 January 2019),[...]; similar for WeHeartit; the use of Pinterest and Tumbir is subject to registration. 
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a virtual social space for users that would enable them to gather and interact with 
various friends and groups. 

327 Another indication that there is no substitutability with Facebook.com is [...] that 

Facebook’s market entry did not have any influence on Twitter’s market position in 
Germany Like Snapchat and YouTube, Twitter cannot be included under the 

assumption of potential supply-side substitution. As detailed above, it cannot be 
assumed that the service intends to change its application in the short term, expecting 
to keep its user base. 

vi. Pinterest, Instagram 

328 Contrary to Facebook’s view, Pinterest and Instagram are not part of the social network 
market. 

• Pinterest 

329 On its German website, Pinterest describes itself as a “catalogue of ideas people use 
to plan the big and small projects of their lives”.Pinterest claims to be a “visual 
bookmark” helping users find and organise creative ideas. 

330 Online media classify the service as a “social network of pictures” that is counted 
among the microblogging platforms. Users can pin pictures, photos and drawings to 
their virtual boards and make them available either to the public or to defined groups. 
The service’s name is a composition of the verb “to pin” and “interest”. To register, they 
need to enter their name and e-mail address and select from a variety of different areas 
of interest (photography, fashion, shoes, food and drink, home and living etc.). Use of 
the service is subject to registration. The “home” page (“start” feed) shows various 
photos made available by commercial or private boards on the selected topics. Pins 
can be saved to the users’ boards, which can be marked as “secret” if required. Pins 
can be shared (“repinned”) and commented on in other social media. (Real-time) 
conversations can also take place via the message function. Other users can be invited 
to jointly collect pins on a separate board. Users can follow all or selected boards of 
other users. 

331 Based on its application and characteristics, Pinterest is not part of the social network 
market. The service rather focuses on collecting, organising and viewing commercial 
and private photos, with relatively limited communication on them. Commercial pins 
appear in large numbers on the start feed based on the interests the user indicated. 


3 ^^ [...] 

3^*8 cf. description of the smartphone app in Apple’s app store, accessed on 21 August 2017. 

3'*® Cf. (German) description in Pinterest’s help centre, https://helD.pinterest.com/de/auide/all-about-pinterest , [...] 
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They serve to collect shopping ideas and as product advertisements. In the area of 
private interests, Pinterest can be used for “photo blogging”, which is a mixture of 
blogging and content sharing. 

332 The user survey confirms this view. Only 2% of the users said they used Pinterest as 
a “social network”, while 11% actually used Pinterest.^^° This is already an indication 
that users do not consider the service a social network. When it comes to the various 
applications, the respondents named Pinterest at best as their second most frequently 
used service, and only a small share of them ranked the service that high. Only 4% of 
the Pinterest users said Pinterest was their second most used service for 
“entertainment and pastime”. An even smaller share of Pinterest users named Pinterest 
their second most used service for following “brands and celebrities” or “obtaining 
information on events or products” (less than 1% in each case). The time spent on 
Pinterest is similar to other content platforms like YouTube or Twitter: 




YouTube 

Facebook 

Pinterest 

Is used 


79% 


58% 

11% 


of which: 

more than once per day 


10% 

49% 


9% 


once per day 


8% 

16% 


11% 


several times a week 


23% 

11% 


13% 


once a week 


12% 

6% 


6% 


several times a month 


16% 

5% 


15% 


approx, once a month 


15% 

6% 


19% 


less often than that 


17% 

8% 


28% 


333 All in all, this service thus cannot be considered a virtual social space for users to gather 
and interact with various friends and groups. As with other services, Pinterest cannot 
be included under the assumption of potential supply-side substitution either. As 
detailed above, it cannot be assumed that the service would be willing or able to change 
its application in the short term while expecting to keep its user base. 

• Instagram 

334 Contrary to Facebook’s view, Instagram is not a social network which could be 
considered a potential substitute for Facebook.com, despite the fact that there are 


350 


[...] 





96 


certain overlaps and links between the two services. Instead, it is a mobile photo 
service with a microblogging function, putting the service in a competitive position to 
Snapchat on the one hand and YouTube on the other. 

335 Instagram contains some key elements of a social network, e.g. the obligation to 
register and options to create a relatively comprehensive user profile. Users can look 
for people they want to follow and “followers” can follow them. Contacts from their 
address books can be uploaded to see if they use the service too. If Instagram users 
also use Facebook, their Facebook friends can follow them on Instagram if they also 
use that service. With its “Discover People” function, Instagram suggests other users 
and also accesses Facebook data for this purpose. The service also has a start page 
listing the photos and videos posted by the people a user follows. The service is also 
used by a significant number of companies and celebrities, and users can follow them 
too. 

336 With communication being limited to photos and videos, the service cannot be 
classified as a social network. The service is rather to be placed among the content 
platforms, as its attractiveness is mostly based on the number and relevance of the 
posted contents and to a lesser extent on the private users’ identities. While it is now 
possible to create a “private account” which is only visible to users the owner approved, 
Instagram has been created for public use which generates more “followers”. 
Instagram’s incentive structure is similar to YouTube’s, as users can make their 
accounts available as advertising channels. If they generate enough followers, they 
receive advertising revenues. “Product placement”, for example, can generate 
advertising revenue. Users take pictures of a certain product and upload them to their 
Instagram account. Such potential advertising revenue is a significant incentive for 
having a public account. 

337 As on YouTube, some Instagram stars are only known on this specific platform. The 
large number of celebrities on Instagram makes the service interesting for so-called 
influencer advertising. Influencers are active in social media and have the potential to 
generate revenue with advertising and marketing due to the influence they have gained 
on their followers with their strong presence and reputation, content product and 
distribution. They are also used for marketing purposes in the respective social media. 

338 In a private context, the service functions as an online photo diary and, like Snapchat, 
it has a photo chat function including options to edit photos before sending them. 
Additionally, Instagram “stories” can be created. The service can also be used 
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exclusively as a mobile app or mobile website. 37% of Instagram users are 14 to 19 
years old.^®^ 

vii. Other services 

339 Other services considered, e.g. Apple Photos, Flickr, MySpace, Reddit, Tumbir, Vimeo 
and Yelp are not to be included in the relevant market for social services either. 

340 Flickr is a photo service with blogging function offering similar functionalities and 
applications to Pinterest and Instagram. It is thus not to be categorised as a social 
network. The explanations on Pinterest also apply in this case. Apple Photos is not to 
be included either. There is reason to doubt that the service actually is a social medium 
at all as the only communication option it offers is sharing photos via other social media. 

341 Tumbir is also a blogging service focusing on photos. However, like Reddit, its 
applications and functions are comparable to Twitter. The services are used for public 
communication only, with Tumbir lacking a comments function. Both services are also 
mostly in English and cannot be attributed to the social network market for the same 
reasons applying to Twitter. 

342 Like YouTube, the Vimeo portal cannot be attributed to the same market as 
Facebook.com. The explanations on YouTube also apply in this case. What is more, 
most parts of the service are subject to fees and address a professional user group. 
My Space is not attributable to the social network market either. The service has a 
clear focus on music and mostly serves for marketing and raising awareness for 
musicians and bands as well as helping musicians stay in touch across borders. The 
applications of MySpace mostly include elements of content platforms like YouTube, 
but also elements of a professional network for musicians. 

343 Finally, the online business guide Yelp and similar services are not part of the market 
either. Users use these services for other purposes than those of social networks. They 
mostly look for and compare service or product offers to book or buy them. Other users’ 
ratings help them decide which offer to choose. The providers’ information is 
complemented by the perception of those who have already used the product or 
service. Many users benefit from these ratings as these potentially offer an independent 
and subjective assessment as a basis for comparing one product offer to another. 
Some of the services’ characteristics are similar to Pinterest, which is not part of the 
relevant market either. 


httDs://www.crowdmedia.de/social-media/instaaram-nutzerzahlen-in-deutschland-2018/ (in German, last 
accessed on 10 January 2019). 
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(3) Geographic market definition 

344 The geographic social network market area is Germany, which is supported by the 
outcome of the investigations into the actual use of social networks in Germany (see 
a) and the existing special characteristics in Germany (see b). Additionally, the market 
affected by the conduct does not extend beyond Germany’s borders for reasons of 
supply-side substitution (see c). 

(a) Actuai nationai use 

345 With the actuai use of social networks being mostly limited to users based in Germany, 
defining the market as Germany-wide seems appropriate. 

346 Social networks are available worldwide and both Facebook.com and, while the service 
was on the market, Google-i-, are designed for international use. 53% of the users said 
in the Bundeskartellamt’s user survey that their decision to use a network was based, 
among other aspects, on the criterion that “people from various regions or countries” 
use the network too.^®^ Facebook.com and the former Google-i- service are attributable 
to the respective domestic markets, irrespective of the fact that there are also networks 
(Stayfriends, StudiVZ, Jappy.de) which basically focus on the German market. In fact, 
German users mostly use the network to connect with their Germany-based friends. 

347 However, according to the user survey, for approx. 85% of the users the decision to 
use a social network is based on the fact that their friends also use the social 
network.^^^ In addition, the user survey showed that, with respect to Facebook.com, 
approx. 80% of the users said most of their friends lived in Germany, approx. 15% have 
friends both in Germany and abroad and less than 2% said most of their friends lived 
abroad.^^"* The identity-based network effects mentioned above, which are a typical 
characteristic of social networks, thus mostly take effect within the national borders, as 
the relevant friends of more than three quarters of all users are located within these 
borders. Network effects work in favour of social network providers whose networks 
have a large user base in Germany, as their users are highly likely to find their friends. 

(b) National specifics 

348 For international social networks like Facebook.com and formerly Google-r, the user 
interface has the same design worldwide. However, their services are offered under a 
national domain in each country. Language settings also vary according to user region. 


352 [...] 

353 |- ] 

354 [...] 
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Services like Odnoklassniki (see para. 192) are not to be included in the market as 
German users would not find other users mostly communicating in their language on 
that network, so social interaction, which is a key element of social networks, would not 
be possible. Content users share on Facebook.com, e.g. by clicking “Like” or “Share”, 
is often in German as it refers to regional or national topics based on the users’ 
interests. The same applies for German-language advertising that matches the 
interests of German users. 

349 German users use Facebook.com in a way that differs from other European countries. 

j- j355 

(c) Service providers unable to perform supply-side substitution 

350 Supply-side substitution from other national markets cannot be assumed as it is not 
possible to successfully enter the German market from other geographic markets in the 
short term and at reasonable economic cost due to the identity-based direct network 
effects in place. The users’ national focus when using a network makes it difficult to 
expand the network's geographic orientation and, for social media which previously 
had a different market position, it is equally difficult to expand their scope of functions. 
This type of market entry would require to build up a network with an entirely new user 
base. As is the case when it comes to transferring a network's scope to a newly 
developed service, it is not possible to expand the existing geographic scope with 
reasonable economic effort in the short term, due to the direct network effects. 

351 The national networks Stayfriends and StudiVZ have thus not been very successful in 
their attempts to grow in other European countries: StudiVZ tried to expand to other 
European countries but discontinued its efforts in 2009.Stayfriends is only active in 
the German-speaking area. While the company does have a Swedish (Stayfriends.se) 
and a French branch (Trombi.com), these are separate services with very small user 
numbers.®®^ 

c. Online advertising markets 

352 The market side of advertisers on Facebook.com is also affected by the conduct under 
review. The advertisers mainly provide targeted advertising for which a considerable 
amount of data has to be processed. As has been outlined, the market side of the 
advertisers has to be considered separately from the other market sides of the social 


355 j- ] 

356 http://www.chip.de/news/StudiVZ-schliesst-fremdsprachiqe-Ableqer 34078550.html f...] 
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network. The affected market is the national market for non-search online advertising. 
It can be left open whether a submarket for non-search social media advertising exists. 

(1) Definition of the product market 

353 According to the Bundeskartellamt's investigations, online advertising and offline 
advertising are separate markets (a). When it comes to online advertising, product 
markets for search and non-search online advertising have to be differentiated (b). 
According to the Bundeskartellamt’s investigations, there are indications that non¬ 
search online advertising can be broken down further into advertising on social media 
or networks, particularly Facebook.com, and other non-search advertising (c). 

(a) Online vs. offline advertising 

354 The Decision Division’s investigations have confirmed what the Commission and the 
Bundeskartellamt have been implementing, namely that, from the customers’ 
perspective, online and offline advertising need to be differentiated. 

355 From the perspective of the advertisers and media agencies questioned, online 
advertising has some significant advantages over offline advertising, one of them being 
that online advertising provides considerably better opportunities to address the target 
groups. The respondents said it was easier to identify and address target groups online. 
Additionally, they found online advertising to be beneficial from an economic point of 
view and said it offered a better return on investment and, all in all, was often cheaper 
than offline advertising. Additionally, online advertising was considered to be 
particularly flexible, quick and easily scalable. In the respondents' view, online 
advertising also offered better opportunities to measure and track success. Companies 
with a high visibility online emphasised that online advertising facilitated direct 
interaction with customers without having to switch media. 

356 As to the disadvantages of online advertising compared to offline advertising, some of 
the companies questioned stated the fact that not all relevant target groups could be 
reached online to a sufficient extent (e.g. women over 65). In addition it was also stated 
that the environment in which online advertising appears is difficult to control. Some 


358 Cf. e.g. BKartA, decision of 11 June 2015 - B6-22/15 - Funke/Springer/Media Impact- para. 213 ff.; European 
Commission, decision of 18 February 2010 - COIVIP/M.5727 - Microsoft/Yahoo! Search Business, para.61; 
decision of 11 March 2008 - COMP/M.4731 - Google/DoubleClick, para. 44 ff. 

359 ] 
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companies also pointed out that the scope of online advertising was not as wide as that 
of offline campaigns. Fraud issues (“ad fraud”^®°) were also often mentioned. 

357 There is also only very little tendency to shift online advertising budgets to offline 
advertising, which also contradicts the argument that one form of advertising can 
substitute the other.^®^ 

(b) Search and non-search advertising 

358 The Bundeskartellamt’s investigations have also shown that search and non-search 
online advertising have to be considered as separate markets. The Commission had 
previously left this question open in its decisions.A large majority of the advertising 
companies surveyed consider search advertising a form of advertising that is separate 
from online advertising in general.According to the surveyed companies, search 
advertising has a number of specific benefits compared to other forms of online 
advertising. Search advertising plays a particular role when it comes to generating and 
measuring conversions, i.e. the number of users of a website that actually buy the 
product. They also underline the high relevance search advertising has for customers. 
In addition, several companies surveyed consider search advertising a particularly 
efficient form of online advertising. 

359 Some companies said that the different types of online advertising addressed different 
“funnels”, i.e. different stages of a customer’s buying process. Search advertising is 
especially relevant at the last stage of the funnel, i.e. at the end of the buying process, 
while non-search advertising, especially display and social media advertising, rather 
takes place at the first stages (“at the beginning of the customer journey”). Other 
companies consider search advertising an especially effective “pull” channel for selling 
goods to customers who already have a specific demand. Several companies also 
point out that search advertising was hardly suitable for developing brand awareness 
or generating demand for a certain product (“push marketing”).^®® 

360 The companies surveyed also see hardly any options to substitute search advertising, 
in particular advertising on Google search, which is considered the most important 


https://www.die-webseitenverbesserer.de/bloa/betrua-der-online-werbuna-ad-fraud-als-unterschaetztes- 

probiem (in German, iast accessed on 10 January 2019). 

361 [...] 
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363 Cf. COi\/IP/M.4731 - Google/DoubleClick, para. 48 ft.; COMP/M.5727 - Microsoft/Yahoo! Search Business, 
para. 62ff. 
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online advertising option.^®^ The investigations have also shown that price increases 
for search advertising do not lead to budget shifts to other forms of advertising. Hence, 
the price sensitivity for search advertising and the fact that providers of search 
advertising are not replaced by providers of non-search advertising also support the 
argument that separate markets exist. 

(c) Possible separate market for non-search advertising on social media or social 
networks 

361 The Bundeskartellamt’s investigations have revealed strong indications suggesting that 
non-search advertising on social media and search advertising outside social media 
could represent separate product markets. The primary reason for this is that, 
according to the surveyed companies, the two forms of advertising fulfil different 
advertising purposes. The companies said that social media advertising was better 
suited for targeted approaches to certain target groups and for linking advertising to 
social and emotional elements. Further benefits indicated include the minimisation of 
scatter losses and opportunities for cross-device tracking. There are also indications to 
suggest that there is a separate market for social network advertising within the overall 
social media advertising market. 

362 The assumption that a relevant product market exists for non-search advertising on 
social networks, in this case Facebook in particular, is supported by the fact that the 
companies surveyed said the data Facebook collected were an advantage of Facebook 
advertising as opposed to advertising on other social media sites. The 
Bundeskartellamt’s investigations have shown that the data Facebook collected and 
made available for advertising purposes were considered an important advantage of 
advertising on Facebook besides the service’s wide coverage. 11 out of 13 media 
agencies which responded to the questionnaire said that advertising on Facebook 
offered good targeting opportunities or very detailed user data, which was an 
advantage over other social media services.®®® A large number of advertisers considers 
the good targeting options and comprehensive user data a benefit of advertising on 
Facebook.®®® They often mentioned as advantages that data specified users’ interests, 
offered very fine-grained details and user-based profile information. 


36 ^ [...] 
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363 The exact market definition of non-search advertising, however, can be left open as 
Facebook’s exact position on these markets is irrelevant for the purposes of abuse 
control. 

(2) Geographic market definition 

364 Based on the general practice of competition authorities, advertising markets are 
defined as national markets. This makes sense in view of language aspects and 
consumers’ national preferences. 

d. Markets for sociai piug-ins, centrai iog-ins and measurement and anaiysis 
services 

365 Facebook’s data processing from Facebook Business Tools also affects markets on 
which Facebook offers social plug-ins, Facebook log-in, measurement and analysis 
services and other developer tools. 

366 As detailed above (see para. 365ff.), the services stated have to be separated from the 
other market sides (private users, publishers and advertisers). It seems reasonable that 
with regard to the individual tools and products, further submarkets can be assumed to 
exist. These are also to be defined as national in view of the fact that private users use 
the social networks in a national context, and the products are linked to them. 

367 The fact that the services are available free of charge does not disqualify them as 
market services. Rather, these services qualify as markets pursuant to Section 18(2a) 
GWB as each of them constitutes a market side of the platform, which serves a single 
business purpose with its advertising revenue and fees. They all utilise the wide 
coverage generated by the offer of their social media or other services for private and 
professional users, which makes it attractive for websites and apps to use the tools 
connected to them. When using the tools, in particular the Facebook Business Tools, 
data will flow, which can be considered a compensation for using the tools. 

368 It seems reasonable to assess social plug-ins which are integrated into websites and 
apps via interfaces and and allow their users to publish and spread their contents on 
social media, as a market. Especially the “Like”, “Follow” and “Share” buttons serve a 
single purpose and are offered by various social media. Twitter offers tools which are 
similar to Facebook’s plug-ins (particularly the “Tweet” and “Follow” buttons)^^°, and so 


https://developer.twitter.com/en/docs/twitter-for-websites/overview.html (iast accessed on 10 January 2019). 
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do Pinterest (“Pin it” button)^^\ Xing (“Share” button)^^^, Linkedin (“Share”, “Follow”)^^^ 
and many other services. Many websites feature more than one of these interfaces. 

369 It is not clear whether social plug-ins are in competition with one another or whether 
they complement each other. The social plug-ins, e.g. the “Follow” button, are also 
often a link to the publishers’ market side on social media. In individual cases, this could 
be an argument in favour of treating these market sides as one. The technical platform 
on which the plug-in is to be included, i.e. whether it is designed for a website or an 
app, could be another differentiating criterion. However, the exact market definition can 
be left open in this case. 

370 It also seems obvious that there is a separate market for single-sign-on services, on 
which Facebook is active with the “Facebook Log-in”. Websites and apps can use them 
to facilitate registration with their own services. 

371 Websites and apps have a specific interest in registered users, as their registration 
provides them with identifying user data which can be complemented by further data 
through cookies. With this data websites and apps can create larger user profiles 
themselves and offer them to their advertising customers. Users benefit from a very 
simple registration process which does not require any further data once the data on 
the existing accounts has been entered. Besides social media (e.g. “Google Sign 
In”^^'^), such log-in services are provided by major trading platforms like Amazon Log¬ 
in and Amazon Pay, and by cooperations of web services like the “European Net ID 
Foundation”^^® or “Verimi”^^®. 

372 It can also be left open whether further submarkets can be assumed to exist. Such 
markets could be defined according to the different services providing the user base, 
which can have completely different registration data sets. 

373 There is obviously also a market for measurement and analysis services on which 
Facebook is active, in particular with Facebook Analytics, but also with Facebook Pixel 
and the analyses offered by this tool. Further submarkets could be defined, e.g. based 
on the criterion of whether the product analyses the effect and success of the specific 
ad published by the respective supplier. Facebook offers, for example, “conversion 


http://www.addthis.com/social-buttons/pinterest/ , [...] 

https://dev.xina.com/pluains/share button (iast accessed on 10 January 2019). 
https://developer.iinkedin.com/pluains , iast accessed on 10 January 2019). 
https://deveiopers.aooaie.com/+/web/sianin/ , last accessed on 10 January 2019). 

Cf. https://enid.foundation/ (last accessed on 10 January 2019) and 

https://www.wuv.de/medien/rti orosiebensat 1 und united internet gruenden eurooean net id foundation 

(iast accessed on 10 January 2019). 


https://www.verimi.de/ , cf. also https://t3n.de/news/loain-dienst-verimi-tvpisch-1014010/ (iast accessed on 10 
January 2019). 
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tracking” via Facebook Pixei. Another possibie submarket couid be defined for products 
that offer websites and apps statistics on the use of their services regardiess of the 
advertisements they inciude. The iatter describes the activity of “Facebook Anaiytics” 
and “Googie Anaiytics”. When measuring advertising success, each affected oniine 
advertising market couid aiso be taken into account as offers are often bundied. Again, 
the exact market definition can be ieft open. 

2. Market dominance 

374 Facebook is the dominant company in the nationai market for sociai networks for 
private users pursuant to Section 18(1) in conjunction with (3) and (3a) GWB as, based 
on an overaii assessment of aii factors of market power, the company has a scope of 
action in this market that is not sufficientiy controiied by competition. 

375 The question of whether and to what extent market dominance is to be assumed to 
exist on the other markets affected can remain open. 

a. The concept of market dominance in the case of markets for free services 

376 In the case of services provided free of charge which constitute markets in accordance 
with Section 18(2a) GWB (as applicable for most sides of the market of the social 
networks relevant in this context), it is still decisive for determining whether market 
dominance exists pursuant to Section 18(1) GWB to establish whether the company 
has a scope of action that is not sufficiently controlled by competition. According to the 
case-law, this scope exists if its position in the market enables the company to prevent 
effective competition being maintained on the relevant market by giving it the power to 
behave to an appreciable extent independently of its competitors, customers and, 
ultimately, consumers. 

377 It cannot be argued here that the harm caused by market power is, in economic terms, 
primarily due to the scope for price increases it creates, and that this scope would not 
play any role in the case of markets for free services. The scope for setting prices is 
not the only relevant factor in defining market power. Apart from resulting in excessive 
prices, unconstrained scope of action can also lead to diminished product volume and 
quality, less variety as well as less dynamic innovation.^^^ 

378 Moreover, market power can actually create scope for raising the prices of services 
previously provided free of charge, an opportunity which would not exist in competitive 


Established case-law, e.g. Federal Court of Justice, judgment of 12 December 1978, “Erdgas Schwaben", 
WuW/E 1533, 1536; ECJ, judgment 14 February 1978, “United Brands", case 27/76, para. 65. 

Cf. Bundeskartellamt, Guidance on Substantive Merger Control, p. 2. 
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markets. In economic terms the price of zero must also be considered to be a price. 
Also, price competition is not only about the amount of a monetary payment but is also 
complemented by the conditions the other side of the market takes into account when 
choosing a service and assessing the price charged. This is reflected by the legal 
concept of imposing abusive business terms. Even a low price or a price of zero which, 
however, involves other disadvantageous business terms, can have indirect effects on 
price competition and possible differentiations of the business model. As market power 
restricts the options to negotiate such business terms with the other side of the market, 
such a restriction is covered by the concept of market dominance even if services are 
provided free of charge. 

379 In particular in the case of advertising-funded internet platforms, where direct monetary 
payments by users of the services are replaced by attention marketing and the 
marketing of user data to advertisers in the form of targeted advertising, the scope for 
processing user data which users cannot avoid because of the services’ market power, 
is also a relevant factor in defining market power. This applies irrespective of the 
question of whether the user data themselves are to be considered as payment for a 
service^^® or as a contractual condition serving to maintain a price of zero. Besides, the 
extent of data processing can also be seen as an element of the quality of the service. 

380 The commercial use of the personal data of customers, users and third parties is a 
significant factor for competition on all sides of the markets, in particular in digital 
markets. Businesses therefore strive to gain as much information as possible about 
their (potential) customers in order to improve their products on the respective sides of 
the market, offer personalised services and enable targeted advertising. Digitalisation 
and particularly the internet have made it possible to collect and analyse particularly 
large amounts of data (“volume") from different sources and formats (variety) as fast 
as possible (velocity).^®” Among other things, this enables businesses to build customer 
and interest profiles which are highly relevant for their competitive performance. 

381 Furthermore, the multi-sided character of the market, resulting from funding by 
advertising, leads to different interests being pursued by different groups of demand- 
side users. The advertisers providing funding are strongly interested in very detailed or 
even granular data sets (as well as in gaining the attention and time of the respective 
user). The incentive to make as much use as possible of existing scope for data 


See Commission proposal for a directive “on certain aspects concerning contracts for the supply of digital 
content” of 9 December 2015, httDs://ec.europa.eu/transparencv/readoc/rep/1/2015/DE/I -2015-634-DE-F1- 
1 .PDF (last accessed on 10 January 2019). 

These three terms are predominantly used to describe the characteristics of "big data". They stem from a 
research report by Doug Laney, analyst at Gartner Consulting; see also Monopolies Commission, Special 
Report on "Competition Policy: The challenge of digital markets", 2015, p. 44 with further references. 
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processing is extremely strong as, on the advertising side, the market success of a 
service will increase with the processing of more, and more detailed, user data. Apart 
from the elimination of the opposite market side’s self-determination and possibilities 
for negotiation, the exploitation of a company’s scope for data processing based on 
market power also threatens to result in a transfer of market power from one market 
side to the other. 

382 It cannot be argued that market power will not significantly increase the scope for 
processing data and that this scope already exists without market power. In this respect 
the legislator has come to a different decision and, in view of the relevance of data for 
competition and the risks posed by market power, stipulated in Section 18(3a) GWB 
(new) that access to such data was a stand-alone criterion in the assessment of market 
power. The users’ willingness to share their personal data seems to be stronger than 
their willingness to pay. Personal data are a non-rivalling good which cannot be used 
up. There is no limited budget which would determine the consumers’ willingness to 
pay and force them to economise. For this reason the consumers’ sensitivity with 
regard to sharing their data is perhaps generally weaker than their price sensitivity. 

383 However, scope for data processing still remains a relevant problem with regard to 
market power. This is due to the fact that even on markets where consumers are less 
sensitive to price differences (e.g. in the case of relatively low-cost fees for products 
such as telephone charges), there is still scope for price increases based on market 
power. Furthermore, a typical area where companies have room for manoeuvre in their 
interaction with end consumers is the negotiation of contractual and general terms and 
conditions. It is undisputed that market power expands a company’s opportunities to 
behave independently of customers and end consumers. 

384 The primary problem is that when consumers share their personal data, they are hardly 
able to judge which and how much data are being collected by which company, to 
whom their data will be transmitted and what are the implications of giving consent to 
process their data. This could partially explain the privacy paradox which describes the 
phenomenon that users attach great value to the protection of their privacy, but 
generously share their personal data when using internet services.^®^ 

385 This lack of transparency in data processing is considerably exacerbated by market 
power. Market power makes it possible to process data even against the will of users, 
thus clearly increasing the extent to which data is processed. If, on account of the 


381 Cf. e.g. the article „Das Privacy Paradox: Digitalisierung versus Privatsphare" by Institut der deutschen 
Wirtschaft, Cologne at https://blog.iwmedien.de/das-privacy-paradox-digitalisierung-versus-privatsphaere/ 
(accessed on 27July 2018); Taddicken, M., „Selbstoffenbarung im Social Web", Publizistik (2011) Issue No. 56, 
p. 281 ff. 



108 


market dominance of the company, users have no choice but to consent to their data 
being processed, the investigations have shown that they will skip reading the data 
processing policy since they have to give their consent anyway.^®^ It is thus impossible 
for individual users to identify which data a company has actually collected about them 
and to understand the importance of the personal data added by a user to the personal 
data already collected. Due to market power users cannot avoid the processing of their 
data. 

b. Overall assessment of the factors of market power pursuant to Section 18(3) 
and (3a) GWB 

386 Based on an overall assessment of the factors of market power under Section 18(3) 
and (3a) GWB, Facebook, as the dominant company in the market for social networks, 
has a scope for action and data processing which is not sufficiently controlled by 
competition. 

387 As this case involves a multi-sided market and a network, the criteria under Section 
18(3a) GWB are relevant factors apart from the market structure and the current 
competitors. These are factors that focus on the special characteristics of multi-sided 
markets and networks as well as on the role played by the digital economy that must 
be taken account of in the context of the assessment of market power. While generally 
irrelevant in other markets, these characteristics constitute additional elements of 
market power to be considered when assessing market power pursuant to Section 
18(3) GWB. However, they also specify the factors listed in Section 18(3) GWB, in 
particular with regard to market entry barriers. The factors listed also describe the threat 
of monopolisation through “tipping” which exists in multi-sided markets and networks 
in certain cases.^®^ According to the investigations the market structure (see (1) and 
the other factors of market power under Section 18(3a) and (3) GWB (see (2) indicate 
that the market for social networks is such a tipping market which has seen Facebook 
emerging as a monopolist or quasi-monopolist. 

(1) Market structure and competitors of social networks 

388 According to the Bundeskartellamt's investigations Facebook has a user share of more 
than [...] on a narrowly defined market for social networks including Facebook.com, 
Jappy, Stayfriends, StudiVZ and WizeLife as well as formerly Google-i- (see (a). Even 
if the user numbers of the services YouTube, Twitter and Snapchat (which are only to 


382 |- ] 

Legislative intent on the 9th amendment to the German Competition Act (GWB), Bundestag printed paper 
18/10207, p. 50. 
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be considered as competition from substitutes) are completely included in the 
calculation as well as Instagram which belongs to the Facebook group, this will not 
significantly reduce Facebook’s user-based market share (see (b). 

(a) Market shares 

389 A factor indicating that Facebook has a dominant position in the market is first of all the 
company’s high level of user-based market shares which, based on the 
Bundeskartellamt’s investigations and several metrics available, amount to between 50 
and almost 100% (see i.). Apart from the special characteristics of the market for social 
networks, the share of daily active users of social networks is the most significant metric 
in the assessment of the market position. According to this indicator, Facebook 
achieved a user-based market share of more than [...] in 2017 (see ii.). 

i. Determined shares of users 

390 In order to determine the structure of the market for social networks for private users, 
which is characterised by mostly free services, the Bundeskartellamt examined several 
key figures on which an initial assessment of market shares can be based. These are 
in particular several shares of users which can be expressed on the basis of the 
numbers of daily active users (DAUs), monthly active users (MAUs) and the number of 
registered users of the services. 

391 The social networks Facebook.com, (formerly) Google-i-, Stayfriends, StudiVZ, Jappy 
and Wize.Life were asked to state their quarterly user numbers achieved during the 
previous years. The companies surveyed were able to provide such data for the period 
between the first quarter of 2014 (Q1, 2014) and the first quarter of 2018 (Q1, 2018). 
According to these figures Facebook’s user-based market share in Germany amounts 
to between [...] and [...] % in the first quarter of 2018, depending on the factor 
measured.^®'^ 

392 Based on the daily active users, the calculation of user shares provides the following 
resulP^: 


If an attempt was made to deduct from the total market volume any users who potentially use more than one 
service, Facebook's user-based market share might even be higher. 

385 j- ] 



110 



Shares of users based on daily active users (DAUs) 

Facebook 

Google+ 

Stayfriends 

StudiVZ 

Jappy 

Wize. Life 

Q12012 

[>90%] 

[0-5%] 

[0-5%] 

no information 
provided 

[0-5%] 

[0-5%] 

Q12013 

[>95%] 

[0-5%] 

[0-5%] 

no information 
provided 

[0-5%] 

[0-5%] 

Q12014 

[>95%] 

[0-5%] 

[0-5%] 

[0-5%] 

[0-5%] 

[0-5%] 

Q12015 

[>95%] 

[0-5%] 

[0-5%] 

[0-5%] 

[0-5%] 

[0-5%] 

Q12016 

[>95%] 

[0-5%] 

[0-5%] 

[0-5%] 

[0-5%] 

[0-5%] 

Q12017 

[>95%] 

[0-5%] 

[0-5%] 

no information 
provided 

[0-5%] 

[0-5%] 

Q12018 

[>95%] 

[0-5%] 

[0-5%] 

no information 
provided 

[0-5%] 

[0-5%] 


393 “Daily active users” are users who use the network at least once a day. With an 
increasing user-based market share, Facebook’s share of the market affected comes 
close to a monopolistic position. In the period under review no competitor has thus 
been able to achieve a user-based market share higher than 5%. 

394 Looking at the development over the last 5 years it becomes evident that Facebook’s 
user-based market share has continued to increase in the period under review at the 
very high level that the company had already reached in 2012. In contrast, the user- 
based market shares of Stayfriends and Jappy have been constantly decreasing. As 
StudiVZ has become insolvent, current user figures are not available. It can be 
assumed, however, that the company’s user numbers have stagnated at the level 
reached in 2016 or have even decreased further. Jappy’s and Wize.Life’s user-based 
market shares are hardly perceptible at a very low level and have marginally increased 
over the last two years. Google-i- had temporarily been able to increase its user-based 
market share, albeit at a very low level. It increased slightly during the period between 
the 1st quarter of 2014 and the 1st quarter of 2015. In the following quarters, however, 
its share continuously dropped and finally reached a level of [...]. 

395 The market shares based on the number of monthly active users (MAUs) are as 
follows:^®® 
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Shares of users based on monthly active users (MALI) 

Facebook 

Google+ 

Stayfriends 

StudiVZ 

Jappy 

Wize.Life 

Q12012 

[80-85%] 

[0-5%] 

[10-15%] 

no information 
provided 

[0-5%] 

[0-5%] 

Q12013 

[80-85%] 

[5-10%] 

[5-10%] 

no information 
provided 

[0-5%] 

[0-5%] 

Q12014 

[75-80%] 

[9-14%] 

[5-10%] 

[0-5%] 

[0-5%] 

[0-5%] 

Q12015 

[73-78%] 

[15-20%] 

[l-6%] 

[0-5%] 

[0-5%] 

[0-5%] 

Q12016 

[73-78%] 

[15-20%] 

[l-6%] 

[0-5%] 

[0-5%] 

[0-5%] 

Q12017 

[79-88%] 

[10-15%] 

[0-5%] 

no information 
provided 

[0-5%] 

[0-5%] 

Q12018 

[82-87%] 

[7-12%] 

[0-5%] 

no information 
provided 

[0-5%] 

[0-5%] 


396 Monthly active users are defined as users who used the respective service at least 
once a month within a set timeframe. 

397 With [...], Facebook’s user-based market shares are high in this area as well. They are 
currently on the rise again after a marginal decrease in 2015 and 2016. Google-i-, which, 
until the autumn of 2016, showed an upward trend reaching a share of between [...], 
still had a market share of merely [...] in the 1 st quarter of 2018. 

398 The market shares based on the number of registered users are as follows:^®® 



Market shares based on the number of registered users 

Facebook 

Google+ 

Stayfriends 

StudiVZ 

Jappy 

Wize.Life 

Q1 2012 

[60-65%] 

[5-10%] 

[13-18%] 

[13-18%] 

[0-5%] 

[0-5%] 

Q1 2013 

[52-57%] 

[20-25%] 

[11-16%] 

[9-14%] 

[0-5%] 

[0-5%] 

Q1 2014 

[46-51%] 

[31-36%] 

[9-14%] 

[7-12%] 

[0-5%] 

[0-5%] 

Q1 2015 

[45-50%] 

[35-40%] 

[8-13%] 

[5-10%] 

[0-5%] 

[0-5%] 

Q1 2016 

[45-50%] 

[40-45%] 

[7-12%] 

[5-10 %] 

[0-5%] 

[0-5%] 

Q1 2017 

[50-55%] 

[35-40%] 

[6-11%] 

no information 
provided 

[0-5%] 

[0-5%] 

Q1 2018 

[52-57%] 

[36-41%] 

[6-11%] 

no information 
provided 

[0-5%] 

[0-5%] 


399 Registered users are users who have registered for a service by creating an account. 
Despite an increasing user base in absolute numbers, Facebook’s user-based shares 


387 [...] 

388 j- j 
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dropped from an overall increasing total market volume of more than [...] in the 1st 
quarter of 2012 to between [...] in the 1st quarter of 2016, but rose again to reach a 
level of [...] in the 1st quarter of 2018. On this basis, Google+ reached a considerably 
higher share than based on the other user-based metrics, as does Stayfriends. The 
market shares of these competitors have, however, been decreasing over the last three 
years, also when considering the number of their registered users. 

ii. Daily active users as a key metric in the assessment of market power 

400 In the Bundeskartellamt’s opinion, and contrary to the view held by Facebook^®®, it is 
primarily Facebook’s share of daily active users of social networks which represents 
an important indicator of the network’s competitive significance and market success. 

401 From the Bundeskartellamt’s point of view, in cases involving internet services and 
platforms, market shares can at best be considered as an indicator for the presumption 
of market dominance. In general, a sufficiently meaningful indication of market power 
cannot solely be based on market shares as it is always required to carry out an overall 
assessment of all circumstances of a case. This applies all the more to internet 
platforms and networks within the meaning of Section 18(3a) GWB where, in the 
assessment of market shares, account must be taken of the general tendency towards 
concentration of platform markets with pronounced indirect network effects as well as 
networks with pronounced direct network effects.®®® 

402 In the Bundeskartellamt's view, the consideration of market shares is nevertheless an 
important element of the concept for examination under competition law as it enables 
the authority to describe the market structure and market positions of the competitors 
in their relationship with one another. For the assessment of the market position of a 
leading company in a specific market, its relative market share, i.e. its market share 
lead over its competitors, has always been a more relevant indicator than any absolute 
values. Furthermore, the development of market shares as a dynamic element plays 
an important role in assessing the sustainability of a company’s market position. 

403 This generally also applies to internet services such as social networks, in particular 
with regard to the threat of tipping, i.e. the monopolisation of the market as a 
consequence of self-reinforcing network effects which, if specific factors are present, 
can result in a gradual exit of the remaining competitors from the market and create a 
significant entry barrier. It is precisely the threat of tipping which is covered by the 


389 [ ] 

Bundeskartellamt, Working paper "Market Power of Platforms and Networks”, June 2016, p. 66ff. 
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particular criteria detailed in Section 18(3a) GWB.^^^ Where a strong market share lead 
over competitors which are potentially already gradually leaving the market is 
developing over a long period of time, this can provide a first indication of a tipping 
process or a competitive advantage that competitors cannot catch up on.^®^ 

404 With regard to the mechanisms of network effects that depend in particular on the 
number of users, the intensity of use and also the identity of users, the number of users, 
as a kind of quantity-based market share, plays a much more important role than an 
assessment in terms of turnover volume. A calculation of market shares based on 
turnover figures, a common practice in many cases, will reach its limits in an 
assessment under competition law of online platforms like Facebook, because one or 
several sides of the platform are available free of charge. A purely value-based 
calculation would neglect competition from free or ad-financed services. In the present 
case, practically all competitors included in the assessment (with the exception of 
Stayfriends which was only included as a precautionary measure) offer their services 
free of charge to private users of social networks as this market is predominantly based 
on financing through advertising. A turnover-based assessment thus cannot be carried 
out on the users’ side of market, but only on the advertising side. However, as the user 
side of a platform must be considered to qualify as a market based on Section 18(2a) 
GWB, market dominance cannot only be established on the basis of the adverting side. 
In what is already current practice, a volume-based assessment of market shares must 
in any case be carried out if it is not possible to determine turnover-related market 
shares.®®® 

405 Furthermore, in economic terms, the “installed base” of a network is very important, 
as the consequences of the network effect or the value of the network, respectively, 
depend, among other factors, on this base. Although several definitions exist in the 
literature, the installed base generally depends on the number of users of a service or 
technology and their opportunities to switch.®®'^ In determining whether a tipping 
process is imminent, the Bundeskartellamt considers the installed base of a network to 
be significant for the assessment of the competitive lead of a specific company. The 


Legislative intent on the 9th amendment to the German Competition Act (GWB), Bundestag printed paper 
18/10207, p. 50. 

Bundeskartellamt, Working paper Market Power of Platforms and Networks, June 2016, p. 68 for indirect 
network effects, and p. 101 for direct network effects. 

Cf. Bechtold, GWB, Section 18, para. 34. 

Cf. e.g. Farrell/Saloner, “Installed Base and Compatibility: Innovation, Product Preannouncements, and 
Predation", The American Economic Review, 1986, Vol. 76(5), p. 940-955, who define the previous number of 
users using the old technology as installed base; Malueg/Schwartz, “Compatibility Incentives of a Large Network 
Facing Multiple Rivals", Journal of Industrial Economics, 2006, 54(4), p. 527-567, on the other hand, only 
consider those users of the old technology as installed base who, due to contractual obligations cannot switch 
to the new technology and where competition can thus only affect new customers; Working paper, p. 93 ff. 
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value of the network often only shows if the installed base is sufficiently large, as the 
network effect can be minimal with small user numbers and increases disproportionally 
as the number of users increases, which is a further argument in favour of giving 
precedence to the analysis of user numbers. 

406 However, contrary to Facebook’s view, the number of monthly active users cannot 
simply be used as a so-called “industrial standard”.From the Bundeskartellamt’s 
point of view, the user-based indicator which determines the “use” of a service in an 
individual case must be determined for each individual market and on the basis of the 
specific product in question. The fact that it can be necessary to take into account 
different indicators depending on each individual case scenario is reflected in the 
economic literature some of which differentiates between whether users already benefit 
from (positive) network effects if members of the other user group are present on the 
platform (“membership externalities” or “membership values”) or whether this benefit 
only becomes effective in the case of usage, e.g. when a certain interaction takes place 
(“usage externalities” or “interaction values”).^®® 

407 In the case of social networks it is above all the above-mentioned purpose of finding 
persons the user already knows and connecting with them as well as the daily 
exchange of experiences, opinions and content within specifically identified groups of 
contacts defined by the user which indicates that the number of daily active users is 
the primary indicator of the value of a network and its market success. As described, 
the users’ requirements are determined by the great intensity of use of social networks 
as a virtual social space. Also in the assessment of market shares, the intensive activity 
in terms of time spent by users thus also provides an important indication of the 
competitors’ actual market positions. 

408 For the assessment of the direct network effects present in this case (s. para. 218 
above) and a tipping process, and with regard to the defined requirements, it is 
extremely important for a social network whether users can expect to be sufficiently 
able to interact with their friends. Daily use can thus also cover a qualitative aspect of 
the network effects. This is also reflected by the result of the user survey in which 62% 
of the respondents stated that the regular activity of the other users was at least an 
important criterion for their decision to use a network. 


395 |- j 

Cf. e.g. Weyl, “A Price Theory of Multi-Sided Platforms", American Economic Review, 2010, 100(4), p. 1642- 
1672; Rochet/Tirole, “Two-sided markets: a progress report", RAND Journal of Economics, 2006, 37(3), p. 645- 
667. 
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409 In comparison with the daily active users the measurement of monthly active users is 
less significant as it does not reflect the typical requirements of the users and their 
typical behaviour. Many operators of social networks which participated in the survey 
stated that they also measure their market success on the basis of “daily active users” 

and consider a great frequency of usage (“user engagement”, “virality”, “activity on 
the platform”) to be the key element in the success of a social network.The monthly 
active users metric thus cannot be referred to as an “industrial standard”. Facebook 
itself also regularly states the number of its daily active users (DAUs) in its annual 
reports and considers this metric to be the relevant basis for measuring intensity of use, 
whereas the number of monthly active users is seen as the basis for measuring the 
global active user community. 

410 The success of the business model, which is financed by highly individual targeted 
advertising, is due above all to the strong daily user engagement, the user data this 
involves and the possibility this creates for exposing users to advertisements over a 
long period. The service’s options for monetisation are thus also indicated by daily user 
engagement. 

411 The calculation of user-based shares on the basis of registered users is, however, not 
a significant metric that could indicate the actual market success of a social network.'^^^ 
Although mandatory registration is a typical feature of social networks, there are 
misjudgements regarding the overall number of users (more than [...] in Germany) as 
well as the individual user shares under several aspects. It is not evident whether 
registration is always followed by use of the social network. An explicit termination 
resulting in the deletion of the registration or the user account is not possible at all in 
some cases, or at least this functionality is difficult to find. From the users’ perspective, 
simply not using an account could be seen as an alternative to termination as the use 
of social networks is free of charge on the market concerned, which is why users have 
no monetary incentive to explicitly terminate an account if they do not use the network. 

412 Moreover, the increasing share of users registered with Google-i- would have been 
highly overestimated. This share resulted in particular from the connection of Google-i- 
with other Google services. From 2013 to 2015 users had to have a Google-r account 
in order to be able to register for YouTube. At least until September 2014, users wishing 
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Facebook Inc., Annual Report 2017, p. 33/ 34: “We view DAUs, and DAUs as a percentage of MAUs, as 
measures of user engagement"; "MAUs are a measure of the size of our global active user community." 
(available for download at 

https://s21.q4cdn.com/399680738/files/doc financials/annual reports/FB AR 2017 FINAL.pdf) , [...] 

^01 [...] 
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to set up a GMail account had to set up a Google+ account as well/°^ And at least for 
a short while, Google+ was pre-installed on many Android devices/®^ While Google 
had terminated this compulsory connection between different Google services in 
response to continuous criticism, it is doubtful whether this has led any significant 
numbers of, e.g., YouTube users to delete their Google-i- account. 

413 The Bundeskartellamt therefore bases its assessment of market power on a user- 
based market share of Facebook that has continuously exceeded 90% since 2012, with 
an upward trend. 

(b) Substitute competition by YouTube, Twitter and Snapchat does not significantiy 
relativise Facebook’s market share 

414 The company’s market share of more than [...] is not significantly relativised by 
substitute competition from other social media, in particular YouTube, Twitter and 
Snapchat. This would even apply if these services were included in the market as 
genuine competitors, as called for by Facebook.'*®'* 

415 In the Bundeskartellamt’s view, substitute competition between other social media and 
social networks is not strong enough to actually justify a representation of market 
shares in the market for social networks. 

416 As illustrated by the market definition, other social media do not serve the same 
purpose as social networks. The fact that these media also pursue the purposes of 
communication and online information exchange in the broadest sense does not mean 
that the differences can be seen as a wide variety of product differentiations -, e.g. 
similar to a geographic chain of substitution '*°® or as “closest competitors”. When it 
comes to options for substitution these exist exclusively for one party in terms of 
product overlaps in some features. 

417 Twitter and Snapchat, in particular, can be replaced by the relevant functionalities of 
Facebook.com, including the Facebook Messenger, in many aspects. On the other 
hand, however, Twitter and Snapchat can (and are intended to) replace the 
functionalities of Facebook.com only in limited partial areas and cannot offer a full social 
user experience. Only Facebook.com offers all functionalities that are necessary to 
represent a virtual social space. As a consequence, there is in fact a competitive 

http://www.cnet.de/88137220/amail-konto-setzt-keine-aooale-anmelduna-mehr- 

voraus/?inf bv=5a002dd5671db8487b8b4b3a (last accessed on 10 January2019). 

https://www.smartdroid.de/android-weniaer-apps-muessen-vorinstalliert-sein-aooale-faellt-wea/ (in German, 

last accessed on 10 January 2019). 
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Commission Notice on the definition of relevant market for the purposes of Community competition law, OJ of 

9 December1997, C 372/5, para. 57f. 
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relationship between Facebook.com and the other services. However, this relationship 
does not exist on the market for social networks, but on the markets for the other 
services that must be defined separately. Although Facebook.com also enables video 
upload there is not much overlap with YouTube with regard to the video platform 
function, because on Facebook video uploads are only a tool for social user experience 
within a circle of friends. 

418 Ultimately, however, the market is highly concentrated to the benefit of Facebook, even 
if the daily active users of YouTube, Snapchat and Twitter, in particular, are to be 
included in the market, as claimed by Facebook. If YouTube, Twitter and Snapchat are 
to be included in the relevant market according to the degree of overlaps in some of 
the features, it is not justified to consider WhatsApp and Instagram, important services 
which are parts of the Facebook group, as belonging to different markets. Facebook’s 
reasoning that Snapchat and Instagram belong to the market affected, but not 
WhatsApp'‘°®, cannot be followed. If Snapchat, whose services focus on photos as well 
as messaging, is included in the market, so must WhatsApp as the widest-reaching 
messaging service whose functionalities overlap with services such as Snapchat in 
many aspects. 

With regard to this competitive environment, the shares of daily active users in the 1st 
quarter of 2018 are as follows:‘*°^ 


Service 

DAUs 1st quarter 2018 

WhatsApp 

[40-50%] 

Facebook 

[20-30%] 

YouTube^°® 

[10-20%] 

Instagram 

[10-20%] 

Snapchat 

[0-10%] 

Twitter 

[0-10%] 

Google+ 

[0-5%] 

Stayfriends 

[0-5%] 

StudiVZ 

[0-5%] 

Jappy 

[0-5%] 

Wize.Life 

[0-5%] 
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419 The above figures illustrate that with the WhatsApp, Facebook.com and Instagram 
services, the Facebook group has a registered daily user share of more than [...], and 
thus a significant market share lead over its next largest competitors YouTube and 
Snapchat. Even if the monthly active users were considered, the result would not be 
significantly different. 

420 Even if WhatsApp were to be excluded from the market, as called for by Facebook'*®®, 
Facebook would still achieve a very high share of daily active users with its services 
Facebook.com and Instagram. 


Service 

DAUs 1st quarter 2018 

Facebook 

[30-40%] 

YouTube'**® 

[20-30%] 

Instagram 

[20-30%] 

Snapchat 

[8-13%] 

Twitter 

[0-5%] 

Google+ 

[0-5%] 

StudiVZ 

[0-5%] 

Stayfriends 

[0-5%] 

Jappy 

[0-5%] 

Wizelife 

[0-5%] 


421 Even if analysed on this basis, Facebook, together with Instagram, would still achieve 
a market share of [...] with a significant market share lead over YouTube and Snapchat. 

(2) Criteria defining market power pursuant to Section 18(3) and (3a) GWB 

422 Based on the criteria defining market power pursuant to Section 18(3) and (3a) GWB, 
the high user-based market share of more than [...] is a manifestation of market power. 
Due to the network effects (see (a) and the lock-in effect caused by a high degree of 
incompatibility and the lack of multi-homing by Facebook users within the market (see 
(b), the development of the market conditions on the narrow market for social networks 
suggests that monopolisation due to market tipping can reasonably be assumed to 
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exist. Economies of scale (c) as well as the company’s superior access to competition¬ 
relevant data (see d) and the limited extent of innovation-driven competitive pressure 
(e) are further elements of Facebook’s dominant position in the market. 

(a) Network effects (Section 18(3a) no.1 GWB) 

423 In view of the significant market share lead over its competitors, market dominance is 
indicated in particular by the identity-based positive direct network effects emerging 
among the private users of the social network of Facebook.com. A significant 
concentration process has been developing in the market for social networks which 
can be attributed to the self-reinforcing feedback loop that can be regularly observed 
in positive direct network effects. The indirect network effects occurring at the same 
time due to the multi-sided character of the market lead to a further consolidation of 
this trend. 

i. Direct network effects and self-reinforcing feedback loops 

424 With a product such as social networks, competition is threatened by the so-called 
market tipping effect which is based on the self-reinforcing feedback loops of direct 
network effects. Market tipping means that if the market-specific size of a network is 
exceeded due to the self-reinforcing feedback loop for this network, almost no 
customers will be left for competing networks, and users who previously used other 
networks will switch to the larger one. During this process, most of the current 
competitors will lose out as their shrinking networks are becoming unattractive (“winner 
takes most” or “winner takes all”)‘*^\ which will result in a monopoly or quasi-monopoly 
situation. Until the market tips, the competitive relationship between the providers of 
networks will be characterised by a competition for the market. 

425 This process starts because in direct network effects, as described above in para. 
214ff., the benefit or profit of users depends on the overall number of network users. A 
differentiation must be made as to whether users benefit from a large number of co¬ 
users (positive direct network effects) or from the fact that the number of co-users is 
less significant (negative direct network effects). The self-reinforcing feedback effect is 
only inherent in positive direct network effects where the growth in user numbers gives 
other users the incentive to use the network. Due to the benefit provided by network 
effects users tend to prefer large networks and, in the long term, can gather in a single 
large network."^^^ In choosing a network new users will tend to opt for the network which 


Dewenter/Rosch, Einfuhrung in die neue Okonomie der Medienmarkte, 2015, p. 197 ff. refers to a trend towards 
a “natural monopoly” (“naturliches Monopol”). 

Cf. Bundeskartellamt, Working paper “Market Power of Platforms and Networks”, June 2016, p. 100 
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most of their friends are using (identity of users) or which they expect to be used by 
most of their friends (size of the network). The larger a network, the more attractive it 
will be for new users. 

426 Direct network effects and their self-reinforcing feedback loop thus represent a 
significant market entry barrier. It is of key importance for new suppliers entering the 
market to quickly reach a critical mass which will enable them to benefit from direct 
network effects that create or increase their networks’ benefit.A supplier must 
convince users that the new network will have a permanent, high market presence. The 
new supplier cannot present an existing, sufficiently large network in which users can 
find their communication partners. Suppliers thus depend on the subjective 
expectations of users."^^"^ 

427 The user behaviour described is confirmed in the present case by the user survey 
carried out by the Bundeskartellamt: Users of social media were asked how important 
several specified reasons had been for their choice of a social network. 86% of the 
users said it was important or very important for them that friends, family members and 
colleagues used the network. The overall number of persons using the network was 
referred to by 47% of the users as an important or very important reason for their choice 
of a social network, whereas 62% of the users said it was important or very important 
to them that persons in their geographic vicinity (e.g. city or district) use the network.'^^® 
62% of the respondents considered the activity of users to be important or very 
important for their choice of a network. 

428 The self-reinforcing feedback effect is clearly reflected by the development of the user 
numbers of Facebook.com based on daily active users as well as monthly active users. 
Although there has not been any established method so far for calculating the self¬ 
reinforcing feedback process of direct network effects, the development of user 
numbers as from a network’s market entry can be used as an approximation. The 
“installed base” is a key indicatorforthe significance of the network effect in a market."^^® 

429 The user numbers of Facebook.com have continuously increased since the network’s 
market entry in Germany in 2008:"^^^ 


See also European Commission, "Microsoft/Linkedin", decision of 6 December 2016, Comp/M. 8124, para. 346. 
Cf. e.g. Sailer, Regulierungsbedarf in Netzwerken? Implikationen fur die Internetdkonomie, Die Weltwirtschaft 
2001, 352 f.; also Farrell/Saloner, “Standardization, Compatibility, and Innovation", The RAND Journal of 
Economics, 1985,16(1), p. 70-83; Bundeskartellamt, Working paper "Market Power of Platforms and Networks", 
June 2016, p. 92. 

^15 [...] 

Cf. Bundeskartellamt, Working paper "Market Power of Platforms and Networks", June 2016, p. 93f.; see also 
e.g. Farrel/Saloner, "Installed Base and Compatibility: Innovation, Product Preannouncements, and Predation", 
The American Economic Review, 1986, Vol. 76(5), p. 940-955. 

[...] 
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Quarter 

DAUs (in thousands) 

MAUs (in thousands) 

Q1 2009 

[...] 

[...] 

Q1 2010 

[...] 

[...] 

Q12011 

[...] 

[...] 

Q12012 

[...] 

[...] 

Q12013 

[...] 

[...] 

Q12014 

[...] 

[...] 

Q12015 

[...] 

[...] 

Q1 2016 

[...] 

[...] 

Q2 2016 

[...] 

[...] 

Q3 2016 

[...] 

[...] 

Q4 2016 

[...] 

[...] 

Q1 2017 

[...] 

[...] 

Q2 2017 

[...] 

[...] 

Q3 2017 

[...] 

[...] 

Q4 2017 

[...] 

[...] 

Q1 2018 

[...] 

[...] 


430 In the first year, Facebook.com already had more than [...] daily active users. Within 
one year the installed base increased to more than [...] daily active users, and to more 
than [...] daily active users by 2011. In the following years the numbers of daily active 
users as well as monthly active users continued to increase. In the 1 st quarter of 2017, 
the user base of Facebook.com rose to 23 million daily active users.Although there 
was a slight decline in the number of daily active users in the 1st quarter of 2018, this 
does not reflect a trend for the year 2017. The user numbers have continued to increase 
over the entire year. The number of monthly active users has also remained at a high 
level. 

431 With regard to the significance of intensity of use for network effects, it is useful to look 
at the development of the number of monthly active users in comparison to the daily 
active users. Even if, as called for by Facebook"^^^, the services mentioned above were 
included in the market as genuine competitors, this would not much affect the 
significance of the trend towards concentration in the market for social networks. It can 


See the figures published by Facebook (in German) on 1 June 2017 at 
https://de.newsroom.fb.eom/news/2017/06/eine-communitv-von-30-millionen-facebook-saqt-danke/ , [...] 

^19 [...] 
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be observed that, after strong growth during the first few years, Facebook.com 
continued to win over [...] monthly active users per year in the following years. Over 
time these users have been using the network more and more actively, as is illustrated 
by the fact that, in relative terms, the number of daily active users has increased more 
significantly than the number of monthly active users. The share of daily active users 
in the number of monthly active users has increased from initially approx. [...] to approx. 
[...]. Only in the 1 st quarter of 2018 did the intensity of use slightly decrease. 

ii. Likelihood of market tipping process 

432 The fact that competitors can be seen to exit the market and that there is a downward 
trend in the user-based market shares of the remaining competitors strongly indicate a 
market tipping process likely to result in Facebook.com becoming a monopolist. 

433 Initially, according to press reports, Facebook.com had made a poor start in 2008 and 
clearly lagged behind the market leaders in Germany, StudiVZ and SchulerVZ as well 
as the MySpace music network. Despite its technical superiority, doubts were 
expressed publicly about whether Facebook.com would be able to succeed in the 
competition against the network effects of the incumbents. 

434 At least from 2011, however, the user-based market shares of the competitors 
operating in Germany strongly decreased. According to the Bundeskartellamt’s 
investigations, StudiVZ activities declined at the end of 2010, a trend that rapidly 
accelerated in 201In 2011, Facebook.com overtook StudiVZ in terms of user 
numbers. SchulerVZ discontinued its operations on 30 April 2013. In the autumn of 
2012, StudiVZ was sold to a financial investor and its user numbers continued to 
decline.On 7 September 2017 its owner, Poolworks, filed for insolvency.It is 
unclear whether the network’s operations can continue. 

435 A similar development could be observed in the cases of Lokalisten, Stayfriends and 
MySpace.Despite significant investments by the then owner of Lokalisten, 
ProSiebenSat. 1, the intensity of use also declined by the turn of the year 2009/2010.“^^® 


‘*2° FAZ.NET of 27 April 2008 http://bloas.faz.net/netzwirtschaft-bloa/2008/04/27/facebook-verDatzt-den- 
deutschland-start-249 (in German, accessed on 10 January 2019). 

^21 [...] 

422 J j 

‘‘23 Cf. http://www.spieael.de/wirtschaft/unternehmen/studivz-ist-pleite-a-1166735.html (in German, last accessed 
on 10 January 2019). 

‘‘2‘‘ Cf. articles by the German magazine Focus of 2013 http://www.focus.de/diaital/mvspace-studivz-lokalisten- 
lokalisten-lanasamer-aber-sicherer-niederaang id 3474203.html (last accessed on 10 January 2019); and by 
the German daily Suddeutsche Zeitung of 6 March 2012. 

https://web.archive.ora/web/20120306030551/http://newsticker.sueddeutsche.de/list/id/1273471 (last 

accessed on 10 January 2019). 

^25 [...] 
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User numbers were in decline as from 2011 and could not be stabilised by attempts to 
diversify through the introduction of gaming or dating features/^® The Lokalisten 
network discontinued its operations on 30 September 2016/^^ The reasons given for 
this included Facebook’s market position in the market for social networks which was 
described as a “winner takes all” market.The Jappy social network also initially 
reported a considerable decline in user activity"*^® between 2011 and the summer of 
2012, followed by a continuous decline in user numbers. Stayfriends was able to 
increase its user numbers up until 2011 when, according to Stayfriends, [...]. After this, 
user numbers have plunged Facebook.corn’s user numbers continue to rise. 

436 These developments reflect the competitive effect of direct network effects and the 
market tipping process: Initially there was intensive competition for the market resulting 
in the creation of a powerful network or a monopolist. The decrease in user numbers 
experienced by all competitors from 2011 onwards gives reason to suggest that a 
market tipping process had already started at that time which caused the then market 
leader StudiVZ as well as Lokalisten to exit the market or to be likely to exit the market. 

437 Competition for the market also included the market entry of Google+ in 2011. In 
Germany, Google+ was also able to attract a significant number of daily active users. 
However, its user numbers remained at a relatively low level'*®^ and have meanwhile 
been declining. Its limited initial success can be explained by the subjective 
expectations users have about the potential market presence of the Google service. 
Such expectations play a decisive role in the market entry of network products, as 
described above.Until its market exit, however, there had been no direct 
monetisation of the private service through advertising. Also, in order to differentiate its 
social network from Facebook.com, Google+ repositioned the network and put more 
emphasis on the common interests of users and the possibility to find people to connect 
with. With the launch of the corporate version of Google+ in spring 2018 and the 
shutdown of the consumer version, the business model was changed into a free-of- 


^26 [...] 

Cf. heise-online, “Lokalisten und die Crux mit dem Netzwerkeffekt" of 30 September 2016, 

https://www. heise.de/newsticker/meldunq/Lokalisten-und-die-Crux-mit-dem-Netzwerkeffekt-3338475. html dn 

German, last accessed on 10 January 2019); [...] 
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“*29 [...] https://www.qruenderszene.de/interviews/iappv-matthias-voql (in German, iast accessed on 10 January 
2019). 

[...] 

[...] 

“*22 Cf. e.g. Saiier, Reguiierungsbedarf in Netzwerken? Impiikationen fur die Internetdkonomie, Die Weitwirtschaft 
2001, 352f.; also Farrell/Saloner, “Standardization, Compatibility, and Innovation", The RAND Journal of 
Economics, 1985,16(1), p. 70-83; Bundeskarteiiamt, Working paper "Market Power of Piatforms and Networks", 
June 2016, p. 92. 
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charge service for internal corporate communications. The exit of Google+ from the 
market gives rise to the assumption of an unrestricted trend towards monopolisation. 

438 From the Bundeskartellamt’s point of view, the market success of YouTube and 
Snapchat cannot be used as an argument against the market’s trend towards tipping. 
As discussed, these services are not part of the market. If they were to be included in 
the market, this would not make much difference to the high market shares and 
Facebook.corn’s lead. YouTube is a product which differs from Facebook.com in many 
aspects and, if it were included in the product market, it would not be a close competitor 
in terms of private users, but rather a competitor on the online advertising market, as 
was ultimately confirmed by Facebook’s statements regarding the “competition for the 
users’ time”. 

439 Even if these services can be seen as product differentiations in comparison to 
Facebook.com, it seems likely that the different user preferences have resulted in a 
splitting of the market resulting in monopolisation trends emerging in the individual sub- 
markets. This has also been shown e.g. in the Microsoft/Linkedin merger control 
proceeding in which the Commission considered professional social networks to be an 
independent product market where the threat of market tipping was assumed to exist 
in several geographic markets where competitors were still active (Austria, Germany 
and Poland) because of an expansion of Linkedin’s user base. The concentration was 
only cleared subject to conditions.'^^^ The Bundeskartellamt’s investigations in the 
present case have also shown that Linkedin’s user base has continually grown since 
2008. 

440 Similar developments are likely to take place in the case of video sharing platforms with 
user-generated content, such as YouTube, in the German market. According to public 
statistics, YouTube had a user share”^^'^ of more than 80% in the sector of video 
platforms in Germany in 2016. The next closest competitors, according to this statistic, 
were DailyMotion and Clipfish, each with less than The video platform My Video, 
which had been YouTube’s most significant competitor in Germany for a long stretch 
of time, was given up by its operator ProSiebenSat.1 Media SE in September 2017 and 
had already ceased to be relevant in the 2016 statistics. The platform Clipfish which 
belongs to the RTL group was transformed into the platform “Watchbox” which no 
longer allows user-generated content. 


‘*33 European Commission, “Microsoft/Linkedin", decision of 6 December 2016, Comp/M. 8124, para. 339ff. 

‘*3‘* On the basis of the "monthly unique visitor", a metric essentially comparable to the “monthly active user". 

“*35 Cf. https://de.statista.com/statistik/daten/studie/209329/umfraae/fuehrende-videoportale-in-deutschland-nach- 

nutzeranteil/ (in German, last accessed on 10 January 2019). 
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iii. Indirect network effects raising market entry barriers 

441 In the assessment of market dominance, account must also be taken of indirect network 
effects many of which are created by the fact that Facebook is characterised as a multi¬ 
sided market. The indirect network effects that are combined with the direct network 
effects increase the market entry barriers for social networks even further and thus 
strengthen the trend towards tipping. 

442 Indirect network effects occur in advertising-financed services which can also be 
referred to as “audience providing platforms” (see para. 221 above) because the benefit 
the advertising side derives from the platform depends on the number and composition 
of the service’s users. Positive indirect network effects for advertisers are generated as 
they will profit from large numbers of users and different target groups using a service. 
The indirect network effects of audience providing platforms are often asymmetric as 
enhanced advertising is not necessarily an advantage from the users’ perspective. 

443 For an advertising-financed platform product, sustainable market entry is already more 
difficult right from the start as suppliers must be successful in entering at least two sides 
of the market,in this case the user market for social networks and the online 
advertising market. In the present case, Facebook.com’s high user-based market share 
indicates that advertising-financed business models are successful in the market. A 
payment-based business model going beyond freemium models will have difficulties 
entering the market as users are unwilling to pay for the service.In view of the 
indirect network effects, a critical mass of users representing an attractive target group 
for advertisers must be achieved in order to be able to monetise a product through 
advertising. However, due to direct network effects, such a critical mass is difficult to 
achieve. 

444 Sustainable market entry is therefore considerably more difficult even with a non- 
monetised, free product that is usually required to achieve a critical mass online. There 
are also very little chances for achieving monetisation independently, i.e. not through 
the takeover of the free service by a company active in the market. Only Google-i- was 
able to enter the market with a network that was not directly monetised and to stay in 
the market over a considerable stretch of time with more than only marginal user 
numbers. This was possible because the service could be integrated into the broad 
advertising-financed portfolio with a strong market presence and because the overall 


Cf. Caillaud/Jullien, "Chicken & Egg: competition among intermediation service providers", RAND Journal of 
Economics, 2003, 34(2), p. 309ff. 

[...] 
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portfolio could benefit from the service in terms of data processing by combining 
Google+ data with those collected by the group’s other services, e.g. YouTube. 

445 The “Vero” product whose market entry is pointed out by Facebook'^^®, confirms this 
monetisation problem in the market for social networks. “Vero” is a mobile app which 
describes itself as a “true social network” and which, according to public reports, has 
been available in app stores free of charge since 2015. It is owned by Vero Labs, Inc. 
whose CEO is the Filipino billionaire Ayman Hariri. In early 2018 the app suddenly 
became popular as one of the top downloads of Apple App Store. This is mainly 
attributed to Vero’s advertising claim that it will always be free of advertising, not collect 
any data and not use any sorting algorithms. Vero promised the first million users 
lifetime free accounts. After reaching the one million user mark the service was to be 
transferred into a paid-for business model the costs of which are unclear. Also, turnover 
was to be achieved through commissions on the sale of products. The service has 
meanwhile reached the one million user mark. The free-of-charge offer has been 
extended indefinitely. After two months the rush to sign up with Vero was over."^^^ 

446 What has been shown by Vero is that it is relatively easy at first to win over users within 
a relatively short period of time for a completely free online product without any 
monetisation. This is a very typical form of market entry in the internet, which, however, 
in contrast to Facebook’s claim'^'^°, does not give any indication as to its sustainability. 
The service must prove itself when it comes to its first monetisation, which has not even 
been attempted yet by Vero, particularly if it is to develop into a paid-for business 
model. 

447 In the present case, however, the indirect network effects are not suitable to put into 
perspective the high market shares on the user side in view of the market structure and 
competition on what potentially has to be defined as a larger online advertising market. 
It has to be generally assumed that, due to the indirect network effects, suppliers of 
advertising-financed products will take the effects on each sides of the market into 
account in their strategic decisions. If users leave the platform because of 
disadvantageous strategic decisions made by the supplier on the user side, this can 
have direct negative effects on the advertising side as advertisers consider the wide 
reach of platforms such as Facebook.com to be a great advantage.'^'^^ In the present 
case, however, it cannot be concluded from this that Facebook's scope of action on the 
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Cf. https://www.qiqa.de/extra/social-media/specials/was-ist-vero-die-social-app-erklaert/ (avaiiabie in German 
oniy, iast accessed on 10 January 2019). 
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user side is sufficiently controlled by indirect network effects affecting the advertisers’ 
side of the market or by competitive pressure on the advertisers’ side. Contrary to 
Facebook’s view'^'^^, a detailed investigation and consideration of the competitive 
activity on the advertisers’ side is not required as this cannot be assumed to have 
positive effects on the services’ side even if a competitive market were assumed to 
exist. 

448 The possibility of users leaving the network is considerably restricted due to the 
combination of indirect and direct network effects. Users switching to another network 
would lose their contacts as it is unlikely that their friends and other contacts will switch 
as well (see para. 460 ff. below for details on obstacles preventing consumers from 
switching due to the lock-in-effect). In view of the role played by the social network as 
the online reflection of their social environment and activities, users often cannot even 
refrain from using the network as this would isolate them from their contacts and the 
exchange of information.'^'^^ 

449 Furthermore, as discussed above, competition on the advertisers’ side precisely 
creates a strong incentive to use the scope for data processing as the market success 
of a service will increase on the advertisers’ side if more and more detailed user data 
can be processed. It is generally difficult for users to track how their data are being 
processed which makes it unlikely that a significant number of users will leave the 
network, irrespective of the direct network effects. A restriction of the scope for 
processing data by a competitive advertisers’ side can therefore not be assumed. Due 
to the fact that the markets are connected, indirect network effects threaten to result in 
the transfer of market power towards the online advertising market. 

450 This has also been confirmed by the investigations which have shown that Facebook’s 
overall advertising revenue massively increased. According to statistics published by 
Facebook'^'^'^, its (worldwide) turnovers doubled in 2017 and 2018 (approx. 100 % rate 
of increase over two years). 
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‘‘‘*3 According to a 2016 study by the California State University, the use of Facebook and other social networks can 
even lead to addiction, cf. httD://www.independent.co.uk/news/science/facebook-could-affect-brain-in-similar- 
wav-to-cocaine-studv-finds-a6877236.htrnl (last accessed on 10 January 2019). 

Cf. Facebook, presentation Q4 Results, slide 4, available at 
https://s21 .a4cdn.com/399680738/files/doc financials/2018/Q4/Q4-201 S-Earninas-Presentation.pdf, [...] 






128 


Revenue 

In Millions 


9 Payments and Other Fees $16,914 



facebook 

4 


451 Based on a national online advertising market for social media, for which the 
investigations have produced some indications, Facebook has meanwhile become the 
market leader in terms of turnover.'^'^^ 

(b) Parallel use of services and high barriers for switching, Section 18(3a) no. 2 GWB 

452 The assumption of market dominance and a monopolisation trend on the user market 
for social networks resulting from direct network effects is supported by a clear lack of 
parallel use of services (multi-homing) on the market concerned. Moreover, due to the 
identity-based direct network effects and the high degree of incompatibility with other 
services, the significant lock-in effect creates high barriers for users wishing to switch, 
and thus ties users to Facebook, which also supports the assumption of a market 
tipping process. 

i. Multi-homing 

453 There is no significant parallel use of social networks in the market which could prevent 
the elimination of competitors and facilitate new market entries. 

454 In general, multi-homing can counteract the imminent tipping of a market which is likely 
to occur due to direct network effects. If users extensively use several networks, this 
can prevent the elimination of competitors from the market even if the market shows a 

[...] 
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trend towards concentration. This can also lower the high barrier to market entry as 
extensive multi-homing helps new entrants to win over customers even if these are 
already using a large network.'*'*® 

455 According to the economic literature, multi-homing is closely connected to product 
differentiation caused by heterogeneous user preferences. In the case of multi-sided 
markets, multi-homing can result from a horizontal platform differentiation in which 
platforms differentiate themselves from their competitors by targeting specific user 
groups. A horizontal platform differentiation, according to the literature, could thus 
result in the emergence of several specialised platforms offering special features. This 
can lead to multi-homing on one or both sides of the platforms, e.g. because users on 
one side of the platform would like to address different user groups on the other side. 
Multi-homing will then tend to have a deconcentration effect, in particular in 
combination with platform differentiation.**^ This concept is generally also used for 
(incompatible) networks.**® 

456 An intensive product differentiation in social networks resulting in multi-homing and 
deconcentration is not evident. In particular, it cannot be decisive whether 
Facebook.com users also use other social media that do not belong to the market for 
social networks. According to the Bundeskartellamt’s investigations, users often use 
several social media in parallel. [...], Twitter users e.g. often also use Facebook.com, 
Instagram, WhatsApp and Snapchat.**® However, as described above, these services 
are used to fulfil different requirements and therefore belong to different markets. 

457 If there is a large number of differentiated social media which offer products that are 
more or less different from one another, it must first of all be investigated in accordance 
with the demand-side substitutability concept whether the differentiated social media 
are functional substitutes and thus fulfil the same requirements. If these differentiated 
products are predominantly used in parallel to complement each other and if they are 
not substitutable for one another, they belong to separate markets. From the 
Bundeskartellamt’s point of view, the concept of multi-homing as relevant under 
competition law only applies if networks are used in parallel on the same market. Only 
in this way it can be determined whether the relevant market’s trend towards tipping 


'^'^6 B6-57/15, OCPE ll/EliteMedianet, decision of 22 October 2015, para. 151 [...] 

Cf. above all Evans/Schmalensee, “The Industrial Organisation of Markets with Two-Sided Platforms", 
Competition Policy Internationai, 2007, Voi. 3, No. 1, p. 151-179; Katz, “Competition policy in network industries". 
Keynote Lecture, Annuai Conference of the German association of economists Verein fur Sociaipoiitik, 2013. 
Katz/Shapiro, “Systems Competition and Network Effects", Journal of Economic Perspectives, 1994, 8(2), p. 
93-115; Doganoglu/Wright, “Multihoming and compatibility". International Journal of Industrial Organization, 
2006, 24, p. 45-67; cf. Bundeskarteliamt, Working paper "Market Power of Piatforms and Networks", June 2016, 
p. 95. 
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can be slowed down and whether the high entry barriers to this specific market can be 
lowered. The parallel use of a product that fulfils different requirement is of no 
competitive relevance for the respective markets, apart from limited fringe competition 
due to the users’ limited time and monetary budget. 

458 The parallel use of Facebook.com and YouTube or other social media is thus not 
directly relevant for Facebook’s market position and the monopoly position. All in all, 
due to the direct network effects, a product differentiation in the case of networks can 
precisely lead to the splitting of the market as described above. Monopolisation trends 
will again occur in such cases on the individual submarkets. 

459 Multi-homing by Facebook users with (formerly) Google-i- and Jappy and possibly with 
the differentiated networks Stayfriends and Wize.Life would be required for a relevant 
effect on Facebook’s market position. Such a parallel user behaviour is not at all evident 
in view of the quasi-monopoly Facebook has established with more than 90 percent of 
the user-based market shares. Effective multi-homing in the market would have to be 
reflected by lower market share leads. Where 90 percent of the users use a specific 
service without any significant overlaps, this can only be qualified as single-homing and 
indicates a market tipping process that has in fact not been prevented by multi-homing. 

ii. Lock-in effect creates high barriers for switching 

460 The high barriers for users wishing to switch which can be observed in the market for 
social networks also support the assumption of market dominance and a market tipping 
process. The identity-based network effects, in particular, lead to a lock-in effect which 
makes it difficult for users or prevents them from switching to another social network. 
The incompatibility between Facebook.com and other social networks, i.e. the 
technological basis of the network effect, is not reduced by the existing features and 
interfaces to other services. 

• Lock-in through incompatibility and identity-based network effects 

461 The high barrier for users wishing to switch is created by the identity-based direct 
network effects that cannot exist across all networks due to the (technological) 
incompatibility of the social networks in the market. Compatibility would neutralise the 
importance of network effects in competition. products are compatible if they are 


Bundeskartellamt, Working paper "Market Fewer of Platforms and Networks", June 2016, p. 62 and p. 101. 

On the market for online dating platforms, high platform differentiation resulted in intensive multi-heming as, 
according to the investigatiens, all the platforms fulfilled the same requirements from the point of view of users 
and were thus substitutable for each other. 

Katz & Shapiro, “Network Externalities, Competition, and Compatibility", American Economic Review, 1985, Vol. 
75(3), p. 424-440. 
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designed in such a way that they can cooperate or interact with each other'^®^ and if 
they are thus substitutable with regard to their function/^'^ In most cases this is not 
applicable to social networks as all their features are customised for one specific 
network which therefore represents a “universe” of its own. In this respect and in terms 
of economics, social networks are comparable to systems of goods or services which 
represent a bundle of mutually compatible, complementary goods or services, that are 
used in the same context and are jointly considered by consumers making a choice. 

It is possible that, based on interfaces, individual functions can achieve a certain degree 
of compatibility. However, elements of the system of network cannot be substituted by 
elements of the other system or network. 

462 Users wishing to switch to such an incompatible network face several different barriers. 
Based on the purpose of using social networks, users will only find it useful to switch 
to an alternative network if they can meet their friends and acquaintances there as well. 
Users wishing to switch would therefore have to convince their contacts in the original 
network to switch to another network as well. As these contacts also have further 
contacts in the previous network, these would also have to be persuaded to switch. 
The more contacts a user has in the previous network, and the more closely these 
contacts are connected with other users, the more difficult or even impossible will it be 
to transfer these contacts to a new network. Users wishing to switch will be faced with 
the question of whether they should still switch to another network if a significant share 
of their previous contacts will not do the same. The incentive to switch to another social 
network therefore decreases with higher intensity of use of the previous network. 

463 It has to be taken into account that the use of social networks can involve much more 
connections than e.g. the use of communication and messaging services. 
Communication services enable direct communication between two users who know 
each other or within a specific group of users. If users of messaging services only 
communicate with a small circle of friends, their address books stored in their devices 
can be uploaded and the group can thus switch to a competing company.'^®^ Social 
networks enable not only direct communication between two users, but also indirect 
interaction where a user can participate, and benefit from, the communication between 
other users. Sharing or passing on posts in social networks thus also enables a tiered, 

^^53 Farrell/Saloner, Competition, Compatibiiity and Standards: The Eeonomics of Horses, Penguins and Lemmings, 
1987, p. 1; Bundeskarteliamt, Working paper "Market Power of Piatforms and Networks", June 2016, p. 92. 

Cf. Pfeiffer, Kompatibilitat und Markt, 1989, p. 23. 

Cf. Steizer, Digitaie Guter und ihre Bedeutung in der Internet-Okonomie, p. 8 f, https://www.tu- 
iimenau.de/fiieadmin/pubiic/iwm/diggut.pdf (iast accessed on 26 October 2018). 

Cf. Economides, Networks and compatibiiity: Impiications for antitrust, European Economic Review 1994, 655; 
id., Desirabiiity of compatibiiity in absence of network externalities. The American Economic Review, 1165ff. 
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indirect interaction which in many cases is also intended. In this way connections are 
established between users who do not know each other.'^^® If users switch to another 
social network, these connections will also be lost if their friends cannot be persuaded 
to switch as well. 

464 In the case of a supplier with a dominant installed base, such as Facebook’s, attempting 
to transfer contacts to a new network and refraining from using the network will both 
cause high switching costs (so-called opportunity costs), which leads to users being 
less willing to switch. Where the installed base of the original network is very large, 
switching to another network will only be attractive for users if the benefit created by 
the new network clearly outweighs the switching costs. The larger the installed base of 
the original network, the higher the benefit of the new network will have to be."^®^ 

465 This cannot be called into question by Facebook’s claim that switching suppliers was a 
gradual process which in most cases did not involve any “clear break” where users 
“moved out” of one network and “moved into” another network (Bundeskartellamt 
unofficial translation).'^®^ This does not change the fact that switching will only create a 
benefit if, at the end of this process, all connections will actually switch to another 
supplier. In this respect, the gradual process means that switching typically involves a 
temporary process of multi-homing. Such multi-homing, however, is not evident 
because, as described above, practically all the competitors’ user numbers are in 
decline, which is why the figures cannot be interpreted as showing a switching process. 
As explained above, multi-homing with products belonging to other markets cannot be 
taken into account in this respect either. 

466 Contrary to the view held by Facebook'^®\ the “Vero” product mentioned above is not 
an example that would be able to disprove the problem of direct network effects and 
the high barrier to switching created by these effects. On the contrary, this is a good 
example for proving the very existence of the problem. Facebook’s statement that 
network effects can easily be overcome by simple information and calls for a switch or 
additional use of the previously used networks, does not hold. Facebook refers to a 
tweet on Twitter in which a user states he would no longer be using Instagram if Vero 
were to remain in the market.It is extremely doubtful whether this can be a real 
option for convincing one’s friends to switch to another network, particularly since the 
networks referred to provide different services. Moreover, Vero, and in particular its 


Bundeskartellamt, Working paper "Market Fewer of Platforms and Networks", June 2016, p. 100 f. 
Bundeskartellamt, Working paper "Market Fewer of Platforms and Networks", June 2016, p. 100. 
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CEO Hariri, have come under criticism due to accusations of corruption, expioitation 
and abuse of power in connection with business operations in Saudi Arabia, which has 
resuited in negative reactions by Twitter users: Tweets marked #deietevero became a 
trend on Twitter.'*®^ This does not appear to be suitabie for reducing the barriers for 
switching. 

467 The finding that there are high barriers to market entry is aiso supported by the 
Bundeskarteiiamt’s investigations and user survey: According to the investigations, a 
Facebook user has an average of [...] friends'^®'^, each of whom aiso has an average of 
[...] friends, etc. in individuai cases the number of friends on Facebook.com is much 
higher and couid inciude severai thousand contacts that are more or iess important. 
Even if not aii of these [...] friends are equaiiy important for the user, the number of 
users that wouid have to be persuaded to switch in order to achieve a simiiariy high 
ievei of benefit is extremeiy high. 

468 The fact that users of sociai networks are reiuctant to switch suppiier is aiso refiected 
in the responses received from the Facebook users who participated in the user survey. 
Asked to indicate reasons in favour of making more use of a different service, 76% of 
the Facebook users surveyed stated they wouid consider this if friends, famiiy members 
and acquaintances used a different service. Oniy a (in some cases very ciear) minority 
of users surveyed indicated they wouid consider any of the other reasons for switching 
iisted by the survey. Oniy 23% thought a higher activity ievei in another service was a 
reason for switching, and oniy 34% referred to better functionaiities as a possibie 
reason. This shows that, if their contacts do not switch as weii, most of the Facebook 
users surveyed consider the costs of switching to another service to be too high to 
make this worthwhiie, even if the new service is a more active or better one. These 
figures iiiustrate that, uniess they succeed to attract the users’ friends as weii, it wiii be 
difficuit for aiternative services to entice users away from Facebook.com by offering 
better features or iess advertisements. . 

• No data portability 

469 Switching is aiso made difficuit because of the iack of data portabiiity. Switching from 
one network to another, incompatibie network not oniy requires users to ieave behind 
or transfer friends and connections; they must aiso set up the new service, a profiie 
and, in particuiar, the information stored in the previous network. Depending on the 
focus of their activities, users activeiy pubiished their own content and consumed, 
shared or commented on content from other users. Over time their user activities wiii 

Cf. https://www.horizont.net/tech/nachrichten/DeleteVero-Warum-der-Social-Media-Hvpe-schnell-wieder- 

vorbei-sein-koennte-165249 (avaiiabie in German oniy, iast accessed on 10 January 2019). 
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thus result in the creation of small or large data sets. The amount of time involved in 
building up a new identity in a different network can deter users from using a different 
network."^®^ 

470 There are only limited possibilities to port the profile and information related thereto to 
other networks. While it is possible to attribute lists of friends and published contents 
to the users, it is more complicated to attribute to users their reactions to the activities 
of other users, e.g. by sharing or commenting on their contents, or conversely, 
responses of others to the contents shared by a particular user. In this case the activity 
of users cannot in any meaningful way be separated from the content on which these 
activities were based or which refer to these activities. Extracting the activities of the 
users is therefore hardly reconcilable with the underlying idea of a social network which 
precisely enables interaction between its users. It is because of the fundamental 
structure of a social network that the transfer of one’s own activities from one social 
network to another is only possible to a limited extent. 

471 Facebook.com offers an export function in its social network which enables users to 
export their own activities in a file (“download your information” function). If users 
request a download, Facebook.com will send them an e-mail with a file which includes 
the user-related content in a browser-compatible list."^®® However, only the users’ own 
content, as published by the users themselves, can be exported. Reactive activities of 
a user cannot be exported, i.e. in particular likes or comments on content published by 
third parties as well as reactions by third parties on contributions published by the 
respective user. The export function offered by Facebook.com is thus not a 
comprehensive feature. 

472 An export or transfer of activities that refer to other users is in fact hardly conceivable. 
A pure export of the content a user created in reaction to e.g. posts by other users, 
would, on its own, be taken out of context. An alternative would be to export the entire 
context in which the user was active as well to ensure that the user’s activity is 
embedded within its context. In particular in the case of very active users, however, this 
would pose not only technical challenges. Also from the perspective of data protection 
law it is doubtful whether users can be allowed at all to transfer third-party content their 
own activities refer to within the context of an export. Furthermore, the data that can be 
extracted by means of Facebook.com’s export function practically cannot be used as 


E.g. for professional social networks, European Commission, “Microsoft/Linkedin", decision of 6 December 
2016, Comp/M. 8124, para. 345. 
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there is no possibility to import them into other networks. The exported data can thus 
rather be used for archiving purposes instead of offering portability. 

• No relevant reduction of lock-in effects through share feature in other 
networks 

473 The connection between Facebook.com and other networks or other social media 
made possible by the share feature (share button) also does not put the significance of 
the network effects into perspective or reduce in any relevant way the lock-in effects. 

474 Via the joint interface defined by Facebook users can post content from other services 
such a Twitter, Pinterest or WhatsApp on Facebook.com by using a sharing 
functionality. Where services have implemented this feature it can be easily and 
comfortably used. Sharing content from Facebook.com with other services, for example 
on iPhones'^®^, is, however, only possible via an additional tool, the AddToAny share 
plugin. This plugin must be actively installed by the user; it is not an integrated feature 
in Facebook.com’s share button. If users click on Facebook.corn’s share button, a 
menu will appear with options for sharing only with Facebook.com itself or the 
Facebook Messenger. For other services, including WhatsApp, users must copy a link 
and insert this in the other service. 

475 Moreover, the share feature requires the parallel use of services in which posts are to 
be made. This also applies to Facebook’s login feature which allows users to register 
in other services with their Facebook profiles. As described above, such multi-homing 
does not take place with Facebook’s competitors to any relevant extent in the market 
for social networks. 

476 The implementation of the share button and the Facebook login involves a considerable 
amount of data being shared with Facebook.com. This means that e.g. data on the 
user behaviour on the implementing website will also be shared with Facebook.com. 
The data shared strengthens Facebook’s data base. Also, Facebook receives 
information on its competitors’ user base which can be used in product competition to 
the benefit of Facebook. 

(c) Economies of scale arising in connection with network effects, Section 18(3a) 
no. 3 GWB 

477 The supply-side economies of scale enjoyed by Facebook combined with the direct 
network effects and lock-in effects support the assumption of market dominance and 
also indicate a market tipping process. 


No such tool is available for Android systems. 
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478 Supply-side economies of scale are particularly significant in the internet economy 
because the development costs of digital goods are in general considerably higher than 
their variable running costs. The higher the fixed costs, the more the costs per user will 
decrease with increasing user numbers. In particular in combination with network 
effects, its lower average costs per user result in Facebook gaining a significantly larger 
strategic scope for action than its competitors, and this scope continues to increase. 

479 The lock-in effect described above aggravates this development and leads to cost 
disadvantages for the competitors. Due to the high switching costs the competitors’ 
prices not only have to be at least as favourable as Facebook’s, but also have to 
compensate for the switching costs if users are to be motivated to switch. This cost 
effect also provides Facebook with more scope of action vis-a-vis its competitors. And 
finally those economies of scale must be considered which result from the joint 
monetisation of Facebook’s services, in particular Facebook.com and Instagram, within 
the context of Facebook’s advertising network. 

480 The joint effect of network effects, lock-in effects and economies of scale ultimately 
leads to a situation where the leading competitor becomes increasingly stronger and 
its competitors become more and more insignificant.'^®® This corresponds to the 
development of the relevant user-based market shares in the market for social 
networks described above and indicates a market tipping process. 

(d) Access to competition-related data, Section 18(3a) no. 4 GWB 

481 Facebook has superior access to data relevant for competition, in particular the 
personal data of its users. In view of its superior installed base, Facebook has a very 
large data base. The data’s level of detail is very high as well because Facebook has 
access to a large number of different data sources. The superior access to user data 
creates an additional barrier to market entry which, in connection with the direct and 
indirect network effects, contributes to the further consolidation of the tipping process. 
The practically unlimited scope of data processing as such already indicates an 
uncontrolled scope of processing user data which represents a competitively significant 
scope of action in the market for social networks covered by the provisions of Section 
18(3a) no. 4 GWB. 

482 From the Bundeskartellamt’s point of view, access to competitively relevant data is an 
important aspect in the assessment of market power of social networks because the 


The economic literature also refers to this joint effect as “increasing returns”, cf. Arthur, Increasing Returns and 
the New World of Business, https://hbr.ora/1996/07/increasina-returns-and-the-new-world-of-business (last 
accessed on 10 January 2019). 
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product in question is a strongly data-driven product whose characteristics and financial 
sustainability depend to a significant degree on the personal user data available. A 
large data base of a market participant as such is not an indication of market power. It 
can, however, play an important role in the overall assessment of all circumstances. 
The high competitive relevance of the data base to a supplier of social networks will, 
however, create an additional barrier to market entry as most competitors, with the 
exception of Google, cannot collect comparable amounts of data, or data with a 
comparable level of detail, as Facebook. This entry barrier further increases the lock- 
in effect created by the direct network effects. 

i. Data sources 

483 As described above, Facebook can use a large number of different data sources. First 
of all the company has access to user data which are created directly when using a 
social network in accordance with its purpose. Via the registration, login and the mobile 
or desktop use of Facebook.com’s start page users already generate a large amount 
of data about themselves to which Facebook has access. In order to create their 
profiles users actively provide data including their real name (real name policy), age, 
sex, relationship status, place of residence, education, occupation, employer, interests 
and hobbies. Users have a strong incentive to provide comprehensive and correct data 
as they mainly use a social network to search for specific other users, interact with 
them and present themselves. Finding other users is considerably facilitated by the 
provision of comprehensive and correct profile information (e.g. real names). 

484 The activities on the social network, e.g. posts and other interactions, provide 
Facebook with information on the persons the user communicates with and the topics 
the user is interested in. The live location feature on mobile devices and technical 
options for the geographic mapping of IP addresses enable Facebook to track the 
locations and movements of users. As users are obliged to create an account Facebook 
can track registered users across devices and see on which devices the social network 
is used. If users upload contact lists to the social network to find friends, Facebook will 
gain further information on the users’ friends and the persons they communicate with. 

485 Facebook also has access to data of persons using other social media owned by the 
Facebook group. These data are based on the personal data of users which are 
combined and matched against Facebook’s data. WhatsApp with 1 billion users 
worldwide and [...] daily active users in Germany, [...], and Instagram with more than 


Bundeskartellamt, Working paper “Market power of Platforms and Networks", June 2016, p. 84, Joint paper by 
the Autorite de la concurrence and the Bundeskartellamt on competition law and data. May 2016. 
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[...] daily active users worldwide and [...] daily active users in Germany, are services 
with a large reach in the neighbouring market for messaging services. 

486 As described above, Facebook also receives detailed data on the user behaviour of 
Facebook users from third-party providers which use the developer interfaces offered 
by Facebook. Via the integration of Facebook interfaces (APIs) which involves the 
placement of cookies on users’ browsers, Facebook can track the users’ behaviour on 
these websites, even if they are not logged into or registered with Facebook. The social 
plugins (e.g. the “Like” and “Share” buttons), in particular, and the Facebook login are 
integrated and used in third-party websites or apps in millions of cases"^^® in Germany. 
The measuring and analysis tools for third-party providers also represent an important 
data source. These tools transmit to the Facebook servers the IP address, type of 
browser, the URLs of the websites visited, the time at which a website was visited and 
other information by means of combining the integrated interface and cookies. The ID 
integrated in the cookies makes it possible to identify the Facebook.com user profile. 
Facebook cookies contain e.g. the user’s specific ID, the browser ID, the timestamp 
and several other data. In mobile apps Facebook can also identify users by capturing 
the advertising ID of the operating system without the use of cookies. In this way 
Facebook gains further information such as the Facebook App ID and metadata such 
as the operating system used, the name and version of the app used, etc. 

487 And finally the advertisers represent a further source of data for Facebook. As 
described above, the identification of target groups (“custom audiences”, “Facebook 
Offline Events”) requires an upload of the advertisers’ hashed customer data which will 
be matched against Facebook data. For this purpose advertisers use their own 
customer lists that include data collected by themselves, e.g. first and last name, 
telephone number, e-mail addresses, city and country of residence, date of birth, age, 
sex, purchasing behaviour, purchase price and several IDs of their customers. 

ii. Competitive relevance of data 

488 Facebook’s data sources are highly relevant for competition because the product of a 
social network is driven by personal data in particular, and the algorithms used for 
interaction ultimately define the product as a provision of data to the users. Superior 
access to these data makes it possible to continuously adapt the products by further 
technical developments and improved personalisation and to achieve other strategic 
business goals. Data sources also secure funding through advertising which, if based 
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on these data, can be precisely targeted and continuously refined. In turn, advertising 
generates new user data. 

489 Personal data are first of all used for personalised content in the News Feed. The news 
feed, which most of the current networks are now using in similar form, is a 
personalised stream of content and activities relating to the user. For an optimum user 
experience, users should mainly be able to see content most relevant to them when 
they scroll down their news feed. All posts are therefore ranked by an algorithm and 
sorted according to this ranking. In order to continuously improve the news feed 
algorithm it is subject to a permanent complex process of adjustment and modification 
based on different influencing factors, for example the data collected. For each 
individual user the algorithm calculates a score for each possible post to the news feed 
on the basis of all factors that have a positive or negative influence on the presumed 
relevance of a post. On this basis the content in each user’s personal news feed is 
sorted. 

490 Three of the main factors influencing the score are affinity, weight and decay. Affinity 
means the user’s affinity to the acting person. It is defined on the basis of the interaction 
with the respective users and their posts. Indicators include contact in the form of posts 
to the timeline, likes, comments, mutual tags, visit to websites, etc. Overlaps with 
regard to the users’ interests, friends and action patterns are also relevant. Weight 
means the significance of a post from the users’ perspective. The assessment is based 
on the interaction of others with the respective post in the form of clicks, likes, shares 
and comments and even the content of the interaction. Personal factors such as the 
relevance of the persons who interacted with the post play a role as well as the click/like 
or click/share quotas. These quotas have a negative influence on the post’s relevance 
and, among many other factors, they are meant to counteract the spread of spam and 
click baits. If the same content was also shared by other persons (friends or third 
parties), this indicates higher weight. Decay refers to the expiration time of a post. 
Recent posts are seen as potentially more interesting than older ones. It will also be 
taken into account, however, whether a post is only interesting in the present situation 
or whether it will remain relevant for a longer period. This is assessed e.g. by looking 
at the reaction (short-term and intensive or long-term and constant). The type of content 
is also important, e.g. whether the post consists of an image, video, text, link, etc. If 
users can be observed to react intensively to images, but rarely click on links, images 
seem to be more interesting to them and will be ranked higher. 

491 The list of influencing factors can be easily extended. Apart from a user’s own 
behaviour, the behaviour of the users who post or interact is also highly significant. 
Interactions of persons who rarely use Facebook.com are potentially more relevant 
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than those of power users. In addition to these factors, non-behavioural factors also 
play a role, e.g. the quality of internet connectivity. Facebook.com’s focus and the 
corporate policy can also have an influence on the algorithm and the position of posts 
in the news feed. It is possible, for example, to control whether posts by friends 
(personal character) or posts by commercial websites (news character) should 
generally be ranked higher. Also, the algorithm generally ranks new Facebook.com 
features higher and thus promotes them. 

492 Moreover, the data collected particularly serve to provide targeted advertising. The 
diverse data sources make it possible to carry out very detailed targeting procedures 
by establishing target groups according to specific personal criteria or consisting of 
individually identified persons (custom audiences and lookalike audiences). Important 
targeting methods such as technical targeting, so-called behavioral targeting, semantic 
targeting and re-targeting can be combined and granular data sets can be used. 

493 Contrary to Facebook’s view it is unlikely that the marginal utility of the data volume will 
always decrease with increasing data collection.'^^^ This may be somewhat different in 
the case of targeted advertising where the benefit ultimately depends on the customer’s 
decision on which product is to be advertised. As far as the further development of the 
service and future business purposes and technologies are concerned, a diminishing 
marginal utility of the data volume is not evident, as stated by Facebook itself. This 
applies in view of the further development of the possibilities to analyse large amounts 
of data, such as in particular Artificial Intelligence"^^^, so-called Deep Learning or, more 
generally. Machine Learning"^^^, which provide possibilities for new business purposes 
and areas of application, and which in return require large amounts of data.'*^'* In its 
data processing guidelines for Facebook.com Facebook states that the information is 
used for the further development of the products, product research and development 
as well as research and innovations on, e.g., issues regarding technological progress 
which is presented as a general welfare issue. In another context Facebook also argues 
that the exactness and degree of personalisation of a social network depended on the 
number and variety of the signals received - the broader the database, the more 
effective the service. 


[...] 

Artificial intelligence is generally defined as the ability ef machines to not only control mechanical processes but 
also perform complex mental processes; an early foundation of Al is considered to have been laid by the paper 
of Alan M. Turing, Computing Machinery and Intelligence, 1950, published in the journal Mind, 1 October 1950, 
p. 433-460. 

Deep Learning and Machine Learning are different methods by which adaptive algorithms can be “trained” to 
improve in the course of their application. 

See also Bundeskartellamt/Autorite de la Concurrence, “Competition Law and Data", May 2016, p. 50. 

^^5 [...] 



141 


iii. Establishment of a further barrier to market entry 

494 In the context of the direct and indirect network effects and the ensuing lock-in effect, 
superior access to competitively relevant data establishes a further barrier for entry to 
the market for social networks and thus also contributes to a market tipping process. 

495 Due to the direct and indirect network effects, Facebook has already achieved a huge 
data advantage which most of its competitors, particularly new entrants, cannot catch 
up with. This is mainly due to the superior installed base which is the foundation of the 
data sources described above and which none of the competitors was able to achieve. 
Its installed base of 23 million daily active users'^^® enables Facebook to collect a huge 
amount of data. It is a special characteristic of these data that their usability and value 
are not merely a product of the data themselves, but mainly result from their 
combination and formation of patterns. The value of each single data element and the 
possibility of gaining insights from these data increases with an increasing amount of 
other data elements available. By means of algorithms the behaviour or the interests 
of a user can thus be predicted. With an increasing amount of data available (user- 
based data, but also data on the overall community) the prediction can be made more 
and more precisely and to the point. The benefit continuously increases with larger 
amounts of data available, especially if they are derived from different sources. 

496 Facebook has a significant advantage over its competitors in the optimisation of its 
news feed algorithm and thus in the development and improvement of its product, and 
this advantage increases as the installed base grows. This can also be seen as a 
further aspect of the self-reinforcing feedback loop as an increased installed user base 
improves the data base which generally further increases the benefit each user derives 
from the network, which in turn attracts new users.The increasing benefit of the 
network increases the lock-in effect resulting from the direct network effects and 
incompatibility. 

497 Moreover, via indirect network effects, the increasing installed base and the ensuing 
amount of data have an impact on the advertisers’ side of the market. If a large number 
of highly interactive users spend much time on the Facebook website, this improves 
targeting options which in turn attracts a large number of advertisers who contribute 
their own data sources, generate further data by means of the Facebook measurement 
tool and make these available to Facebook. The Bundeskartellamt’s investigations 
have shown that the data Facebook collected and made available for advertising 

httDs://de.newsroom.fb.com/news/2017/06/eine-communitv-von-30-millionen-facebook-saat-danke/ _ (in 

German, last accessed on 10 January 2019). 

Cf. Joint paper by the French Autorite de la concurrence and the Bundeskartellamt on competition law and data, 

May 2016, p. 13. 
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purposes were considered an important advantage of advertising on Facebook by the 
companies surveyed, besides the service’s wide coverage. 11 out of 13 media 
agencies which responded to the questionnaire said that advertising on Facebook 
offered good targeting opportunities or very detailed user data, which was an 
advantage over other social media services. A large number of advertisers also 
consider the good targeting options and comprehensive “granular” user data to be an 
advantage of advertising on Facebook as compared to other media.'*^® 

498 Competitors are largely unable to duplicate this data collection. This applies in 
particular to smaller competitors that only have limited options for pooling data from 
different relevant sources. All internet companies use cookie technologies and acquire 
data from third party providers. However, the competitors’ sources are not comparable 
to the data sources available to Facebook through the user base of the social network 
and its own services. According to the investigations, the Facebook’s competitors, with 
the exception of Google, cannot pool data from company-owned services. In the sector 
of social networks, Google was the only company apart from Facebook to offer third 
party websites the share and like buttons and a log-in button. 

499 The Bundeskartellamt’s investigations in the sector of advertisers have also shown that 
Facebook has a unique treasure trove of data: 12 of 13 of the media agencies that 
replied to this question said Facebook possessed data relevant for advertising that 
other providers of online advertising could not deliver. Most agencies stated that 
Facebook had more detailed data than other providers. Some agencies also said that 
Facebook possessed unique data about the interests of users. A large majority of the 
advertising companies also share the opinion that Facebook possesses more data than 
other publishers. They often referred to data about the users’ interests, very fine¬ 
grained details and user-based profile information.'^^^ 

500 The fact that the Google group, which included Google-i- in its portfolio, also has 
extensive access to data does not change the significance of Facebook’s access to 
data with regard to its market position in the market for social networks. Data access is 
connected with the network effects and represents a further aspect in the overall 
assessment. The collection of data available to the Google group, i.e. data from Google 
Search, YouTube, G-Mail, Google Maps, Android and other services, which is also 
pooled based on Google’s respective data processing policies'*®®, is on the whole at 
least comparable with Facebook’s collection of data in terms of volume and level of 


^78 [...] 

^79 [...] 

‘‘89 httDs://www.aooale.de/intl/de de/policies/privacv/?fa=1#infouse (last accessed on 10 January 2019). 
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detail. However, in the case of the private social network Google+, this data base has 
not led to market success as it was not linked with strong, self-reinforcing direct network 
effects. In contrast to Facebook, Google-i- was not the central Google service for which 
data from other services and sources were combined for the benefit of its algorithms 
and funding through advertising. Google-r was rather one of the data sources the 
company tapped into in order to provide online advertising in the other, considerably 
more important Google services. Google-i- users did not receive any ads. 

(e) Innovation-driven competitive pressure, Section 18(3a) no. 5 GWB 

501 Facebook’s market position is currently not threatened by sufficient innovation-driven 
competitive pressure. Under Section 18(3a) no. 5 GWB, account must be taken of 
innovation-driven competitive pressure in the assessment of an undertaking’s market 
position, in particular in the case of multi-sided markets and networks. In contrast to 
merger control, the issue here is not whether and to what extent the innovation-driven 
competition between companies is threatened'‘®\ but to what extent innovations can 
put into perspective the market power of a company.'^®^ 

502 The Internet is generally highly dynamic and characterised by a large amount of 
innovations. Innovative products and services can create and establish new digital 
markets within a short period of time. However, these dynamics can also result in online 
services rapidly losing their significance. Crucial factors in this process are 
characteristic features of the internet, i.e. global networking and accessibility as well as 
high-speed innovations.'^®^ The user behaviour of private users is also subject to 
change, in particular in view of technical innovations. 

503 The innovative and disruptive potential of the internet cannot be used as a general 
argument against the market power of internet companies. If a strong market position 
exists which has been established according to further criteria defining market power, 
this position can only be effectively put into perspective on the basis of concrete 


See Commission, “Dow/Dupont“, Comp./M. 7932, decision of 27 March 2017 in which the Commission held 
that the merger would result In a significant reduction of Innovation competition In the markets for pesticides. 
The merger was only cleared subject to conditions. 

See Bundeskartellamt, Series of papers on Competition and Consumer Protection in the Digital Economy, 
“Innovations - Challenges for competition law practice”, November 2017, in particularp. 16ff., 
httDs://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Schriftenreihe Digitales II.pdf? blob=publicati 

onFlle&v=3 (last accessed on 10 January 2019). 

Evans, “Multisided Platforms, Dynamic Competition and the Assessment of Market Power for Internet-based 
firms”, 2016, 

http://chicaaounbound.uchicaao.edu/cai/viewcontent.cai?article=2468&context=law and economics , p. 10 

(last accessed on 10 January 2019). 

Bundeskartellamt, decision of 22 October 2015 - B6-57/15 - Parship/Elitepartner, para. 174; Working paper, 
p. 74f.; See Bundeskartellamt, Series of papers on Competition and Consumer Protection in the Digital 
Economy, “Innovations - Challenges for competition law practice”, November 2017, in particular p. 24 
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indications in each individual case of a dynamic or disruptive process which could also 
originate from markets other than the relevant one. An abstract challenge expected to 
take place at some unspecified point in the future will not be sufficient. This applies in 
particular to the control of abuse of dominant positions which focuses on the current 
situation. Also in the digital economy it is possible to establish market positions that are 
largely secured over long periods of time, in particular by direct and indirect network 
effects. During these periods the abuse of a dominant position cannot be accepted only 
because the situation can be assumed to change in the future."^®® 

504 There is no sufficient innovation-driven competitive pressure, also from other, 
neighbouring markets, that would, currently or in the near future, be able to effectively 
put into perspective Facebook’s market position in the market for social networks. The 
high market shares and market share leads described above already indicate that 
neither technical disruptions such as the “mobile revolution” initiated by the 
development of smartphones nor competitive moves by competitors have built up 
innovation-driven pressure on Facebook’s market position. The innovative impulses 
provided in particular by competition from substitutes from neighbouring markets where 
competitors innovated and extended their own social media, could be counteracted by 
Facebook by integrating the innovation into its own portfolio. 

505 The recent development of mobile internet use has brought about an important and 
fundamental change of user behaviour in almost all areas. The fast growing and 
massive use of smartphones, which has rapidly developed since the introduction of the 
iPhone in 2007, is generally used as a typical example of a “disruption” which has been 
threatening business models and products. However, Facebook has not been affected 
by this development although the social network was originally designed to be used on 
desktop computers. With the introduction of the iPhone in 2007 the company merely 
launched a mobile version of the website optimised for small displays, and mobile apps 
for iOS and Android were only available on the market from 2012.StudiVZ had 
already made a mobile app available in 2008. Nevertheless the mobile use of Facebook 
has been increasing continuously"^®^ and, according to public statistics, already reached 
more than 50% (worldwide) in the year it was launched."^®® 


Bundeskartellamt, decision of 22 October 2015 - B6-57/15 - Parship/Elitepartner, para. 176; Bundeskarteiiamt 
working paper "Market Power of Platforms and Networks", June 2016, p. 74f. 

486 j- ] 

[...] 

Cf. httDs://de.statista.com/infoarafik/1077/facebooks-mobile-nutzer/7utm campaian=9b9cd60d6e- 

Coid Camp InfographTicker DE pm 36&utm medium=emaii&utm source=lnfoaraphic%20Newsietter&utm 

term=0 666fe64c5d-9b9cd60d6e-295265921 (avaiiabie in German oniy, iast accessed on 10 January 2019). 
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506 The company’s own innovations do not indicate any competitive pressure that 
would have been able to challenge Facebook’s market position so far either. 

507 Facebook points out product innovations launched during the last 5 years which, 
according to the company, included the successful transformation of a “web company” 
into a “mobile first company” (2012/13), the successful decoupling of the Facebook 
Messenger in April 2014, the launch of “live video” in April 2016, and the introduction 
of the privacy settings at the level of individual objects as well as ads settings (“ad 
preferences”). [...] 

508 In the area of photos, Facebook claims [...]. According to Facebook it launched “Poke” 
[...] and discontinued the feature in May 2014. In August 2016, [...], Facebook had 
introduced “Stories” on Instagram. According to the company, its “Camera” app had 
been introduced in May 2012 and discontinued in 2014. Facebook.com had launched 
photo filters and 360 Photo in June 2016 [...]. In June 2015, it had published the 
“Moments” app which organised photos and turned them into clips. In June 2016, 
Facebook.com added “Slideshow” which creates mini-movies from photos. 

509 As to the communications sector, Facebook [...] developing the Facebook Messenger 
as a stand-alone app. Further features, such as following brands, persons or event as 
well as order and/or payments features had been offered by the Facebook Messenger. 
Chatbots had been introduced in the market as new developments. “Lite” versions of 
services had been introduced for slower internet access, especially in developing 
countries. 

510 In the area of content sharing, Facebook claims that innovations had been introduced 
with the so-called Pinboard instead of a news feed by Pinterest and that a re-design of 
YouTube had been carried out based on Facebook.com. In September 2011, 
Facebook had launched its Timeline which many other services also offered today. In 
September 2006, the News Feed had been introduced. Facebook states that 
“Trending” had been introduced in January 2014 [...]. The “Subscribe” function had 
been introduced in September [...]. The “Paper” app, a separate news app for iOS, had 
been launched in February 2014 and discontinued in June 2016. 

511 In 2010, Facebook had introduced its social plugins to enable interaction between 
users; in 2016 the “Like” button had been revamped. Furthermore, Facebook states 
that it had entered the area of services for publishers in 2015, [...]. Facebook also 
states that several different innovations had been introduced for the developer platform 
and advertising services, such as the introduction of the App Center, the “Home” meta 
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app, the 2012 introduction of the developer platform for the Facebook Messenger and 
Facebook Custom Audiences, and the Lookalike Audiences tool introduced in 2013, 
including integrated information gained from tracking. 

512 In the Bundeskartellamt’s view, the further developments described above in fact 
represent a competitive activity which, however, does not go further than competition 
from substitutes by means of some individual marginal features. A substantial part of 
Facebook’s statements describe competitive activities in other markets to which 
Facebook has reacted by introducing innovations on Instagram and the Facebook 
Messenger as stand-alone app, as well as via WhatsApp or other separate apps such 
as “Poke”, “Paper”, “Moments” or “Facebook Camera” rather than in the area of the 
social network. In contrast to Facebook’s claim, this represents different reactions in 
the individual separate markets concerned, in some cases market entries such as the 
introduction of the separate Facebook Messenger app, rather than a reaction taking 
place in the social network market. These reactions are rather attributable to 
Facebook’s substantial scope for expansion which arises precisely from its strong 
market position in the social networks. 

513 Where Facebook claims that relatively fundamental developments and features of the 
social network took place in 2006 and 2011, as e.g. the Newsfeed that was launched 
in 2006, the social plugins introduced in 2010 or the timeline in 2011, this shows that 
Facebook successfully entered the market. The Bundeskartellamt does not dispute that 
there has been intensive competition for this market. 

514 Where Facebook refers to recent developments in the social network, in particular the 
streaming of videos via Facebook Live, the upload of 360 ° videos and photos, Trending 
or the revamp of the Like button, [...]. Although this demonstrates competitive pressure 
on some partial functions of a social network, the developments still represent 
competition from substitutes at the margins of the market which, contrary to the view 
held by Facebook, cannot challenge Facebook’s position in the market. In the opinion 
of the Bundeskartellamt it is not justified to refer to competition on video features as a 
“video revolution” that would be comparable to the “mobile revolution”. Also in the video 
sector Facebook is able to implement the same or similar features very quickly, which 
ultimately means that the innovation resulting from competition from substitutes will 
only have a minor effect in the market for social networks. This also indicates a market 
position which is hard to challenge and which can immediately fend off competitive 
moves by YouTube, the leading competitor in this sector, even those addressing partial 
features. 
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515 Facebook’s statements on innovations in online advertising and the developer platform 
are only indirectly relevant to the user market. The innovations mainly represent a 
better possibility for monetisation and data collection as a reflection of market success 
on the user side. The development of additional apps users can use within the social 
network is certainly an advantageous development of the network. However, this does 
not depend on Facebook, but above all on the creativity of the developers. For 
Facebook, the success of such interfaces is closely connected with the intensive 
network effect achieved which makes the development of additional apps by third party 
suppliers attractive, and which in turn makes the network more attractive for users. The 
quality or innovations achieved by apps for Facebook and the existing network effects 
thus reinforce each other, a circumstance which makes it even more difficult to 
challenge Facebook’s market position. 

516 Against this background it is not convincing that Facebook points out its investments in 
research and developmenh^^^ as the Bundeskartellamt does not deny that the company 
has reacted to innovations by competitors in neighbouring markets. The nature of these 
investments is not evident from the statement either, except in the case of the product 
developments already mentioned by Facebook in the course of the proceedings. 

517 Contrary to the view held by Facebook, the mere possibility of Facebook having to react 
to innovations by competitors in some features and the fact that it cannot remain 
stagnant at a certain product level of the social network, cannot refute market 
dominance. To prove market dominance it is not necessary to demonstrate lower 
technical quality, less investment in research and development and delay in market 
launch.Particularly in view of the provisions of Section 18(3a) GWB, the ability to 
immediately counter competitive moves from outside is also a manifestation of market 
power in the online sector. What is decisive in this respect is the pressure that 
competitors in the area of the innovations can actually exert on the market position. 
This pressure is weak if the innovative activity, which was in fact noticeable, ultimately 
cannot take effect because of a rapid response. For this reason alone it is not 
convincing that Facebook refers to Myspace which had failed to introduce innovations 
in 2009 and exited the market because of this failure. Besides, social media were still 
in development at that time and exposed to competition for the market (see above 
432ff.). 


Cf. Shy, ..Technology revolutions in the presence of network externalities", International Journal of Industrial 
Organization, 1996, 14, p. 785-800; Bundeskarteiiamt, Working paper "Market Power of Piatforms and 
Networks", June 2016, p. 72f. 

^91 [...] 

^92 [...] 
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518 Furthermore, the scope of action which characterises market dominance not only 
includes the scope for innovation or investment activities. As described above (para. 
379ff.), the scope for data processing, which is not affected by the innovation activity 
and product improvement described in the statement, is also part of the scope of action 
a dominant advertising-funded social network has vis-a-vis private users. 

519 This does not mean that a monopoly in a network market, as represented by the social 
networks, cannot be challenged at all. In the case of direct network effects with the 
lock-in effect described above, an attack can only succeed if the users are prepared to 
incur high switching costs. This can only be achieved by innovations if they are 
substitutable with the network effects.From the users’ perspective, however, the 
improvement of individual features, which can also be easily reproduced, cannot 
substitute the network effect. This was also confirmed by the user survey. 

520 As described above, Facebook users were asked to state reasons for which they might 
consider using services other than Facebook. It was possible to list several reasons. 
The reason indicated by 76% of the users was that their friends were using the other 
service. Only 35% of the users would be inclined to make more use of the other service 
if it provided “better features”. 

521 Nevertheless, in the opinion of the Bundeskartellamt it cannot be excluded that future 
innovations and product developments could challenge Facebook’s position or even 
start a process of replacement. At this point, however, there are no specific indications 
of such a development. Despite the substantial innovative power of the internet and the 
dynamics this can involve, there have been no indications during the last seven years 
of any replacement trends or any relevant market share losses for Facebook. 


cf. Shy, "Technology revolutions in the presence of network externalities", International Journal of Industrial 
Organization, 1996, 14, p. 785-800; Bundeskarteiiamt, Working paper "Market Power of Piatforms and 
Networks", June 2016, p. 72f. 

[...] Cf. also the statement by Paul Adams, former Google+ employee: “What people failed to understand was 
Facebook had network effects," says Adams, the former Google+ user experience employee. "It’s like you have 
this grungy night dub and peopie are having a good time and you buiid something next door that’s shiny and 
new, and technicaiiy better in some ways, but who wants to leave? People didn’t need another version of 
Facebook." at http://mashable.eom/2015/08/02/qooqle-plus-historv/#pZVT825xesqH (iast accessed on 10 
January 2019). 
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II. Imposing abusive business terms pursuant to Section 19(1) GWB 

522 As explained in the operative part of the decision, the assessment of abuse of a 
dominant position focuses on conditions which make the use of the social network by 
users residing in Germany conditional on Facebook being able to gather user-related 
and device-related data that were gathered and saved during the use of the services 
WhatsApp, Oculus, Masquerade and Instagram, as well as user-related and device- 
related data on Facebook Business Tools, and combine them without the users’ 
consent with those data that were gathered and saved during their use of 
Facebook.com. The question remains open as to whether it is also inappropriate to 
collect and use user data which result from the use of Facebook services for which 
private users are obliged to register under Facebook’s terms and conditions. The 
conditions relating to the data processing procedures in the context of Facebook 
accounts due to mandatory registration with Facebook.com are not the subject of the 
present assessment of abuse of a dominant position. Apart from Facebook.com this 
also includes the Facebook Messenger. After due consideration of the circumstances 
the Bundeskartellamt exercises its discretion to refrain from carrying out an 
assessment of abuse of a dominant position pursuant to Section 19 GWB. 

523 The use and implementation of the terms of service, which are specified in the data 
and cookies policies or comparable contractual documents and as described in detail 
in the operative part, constitutes an abuse of a dominant position on the market for 
social networks for private users in the form of abusive business terms pursuant to the 
general clause of Section 19(1) GWB because, as a manifestation of market power, 
these terms violate the principles of the GDPR. 

524 Based on the case-law of the Federal Court of Justice, in particular its decision in the 
VBL-Gegenwert cases. Section 19(1) GWB is also applicable to the use of data 
processing terms which, as a manifestation of market power, violate data protection 
rules. It is not blocked by the provisions of the GDPR (see 1.). Facebook’s data 
processing terms are terms within the meaning of Section 19 (1) and (2) no. 2 GWB. 
They must not be assessed on the basis of the criteria of the prohibition of abusive 
pricing (see 2.). The data processing terms violate, to the extent described above, the 
principles of data protection law as expressed by the GDPR (see 3.). As a manifestation 
of Facebook’s market power they are deemed to be abusive practices, also after a 
process of weighing up interests under competition law (see 4.). 
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1. Violation of data protection principles represents abusive practice 

525 According to the case-law of the Federal Court of Justice, the abuse of a dominant 
position pursuant to Section 19(1) GWB, which also covers the protection of 
consumers"^®^, must be assumed to exist where the data processing terms used by a 
norm addressee, as a manifestation of market power, violate the principles of the 
GDPR. (see a.). Along with the data protection law and its enforcement system. Section 
19(1) GWB is fully applicable (see b.). 

a. Taking the GDPR into account within the framework Section 19(1) GWB 

526 Abusive business terms can also be examined based on the general clause of Section 
19(1) GWB. According to the case-law of the Federal Court of Justice, principles from 
provisions of the legal system that regulate the appropriateness of conditions agreed 
upon in unbalanced negotiations can be used as concepts for appropriateness in the 
assessment of abusive practices under Section 19(1) GWB. The principles of data 
protection law underlying the GDPR are thus a suitable standard for measuring the 
appropriateness of the data processing terms of a dominant supplier, all the more so 
since they must be taken into account anyway as a higher-ranking constitutional law 
that specifies constitutionally guaranteed rights. 

527 According to the Federal Court of Justice, terms and conditions are not only subject to 
the specific standard example of Section 19(2) no. 2 GWB and the concept of 
comparable markets it includes. As held by the Federal Court of Justice in the VBL- 
Gegenwert cases, an abusive practice can also be found based on the general clause 
of Section 19(1) GWB, e.g. where general business terms are used that are 
inadmissible under the legal principles of Sections 307ff. of the German Civil Code 
(BGB), and in particular where these practices also represent a manifestation of market 
power or superior market power.In the Pechstein case the Court left open whether 
the business terms used were abusive under Section 19(1) or (2) no. 2 GWB, but 
considered an extensive balancing of interests to be necessary which should also take 
into account constitutionally protected rights. Accordingly, to safeguard constitutionally 
protected rights. Section 19 GWB must be applied in cases where one contractual party 
is so powerful that it would be practically able to dictate contractual terms, thus 
eliminating the other party’s contractual autonomy. If in such a case constitutionally 


Federal Court of Justice, judgment of 07.12.2010 - KZR 5/10 - Entega II, WuW/E DE-R 3145, 3155f., para. 24 
(juris); Bechtold, GWB, 8th edition. Section 19 para. 5. 

Federal Court of Justice, judgment ef 6 November 2013, file KZR 58/^^,VBL Gegenwert I, para. 65 (juris); 
Federal Court of Justice, judgment of 24 January 2017, file KZR 47/14, VBL Gegenwert II, para.35 (juris); in the 
same direction also Federal Ccurt cf Justice, judgment of 7 June 2016, file KZR 6/15, Pechstein/Internatlonal 
Skating Union, para. 48 (juris). 
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guaranteed legal positions are interfered with, the court held that state regulations, in 
particular general clauses under civil law (Sections 138, 242, 307, 315 BGB) which also 
included Section 19 GWB, had to intervene to uphold the protection of constitutional 
rights/®^ According to the Court these clauses should be applied in compliance with 
the fundamental rights and by balancing and restricting the conflicting positions in such 
a way that the constitutional rights of all parties were, as far as possible, effectively 
maintained/®® 

528 With this case-law, the Federal Court of Justice has introduced an 'appropriateness' 
principle which complements the comparable markets principle of Section 19(2) no. 2 
GWB"*®® and is based on constitutional values, the principles of the legislation on unfair 
contract terms and other civil law general clauses.The key element here is an 
appropriate balance of interests in unbalanced negotiations where one party 
unilaterally imposes business terms, as shown in particular by the legislation on unfair 
contract terms. The legal provisions are to prevent a contractual party from losing its 
constitutionally protected right to self-determination in business affairs (contractual 
freedom) because the other party is able to unilaterally determine the terms of the 
contract.®®^ Contract terms that are deemed inadmissible according to the balancing of 
interests under the legal principles laid down e.g. in the legislation on unfair contract 
terms are also to be considered abusive in the context of an assessment to be carried 
out in each case under Section 19 GWB where a sufficient degree of market power is 
involved.®®® 

529 This case-law, which was developed to take into account the appropriateness concepts 
of Sections 307ff. of the German Civil Code (BGB) within the framework of Section 
19(1) GWB, can be applied to all other principles of legal provisions, if a sufficient 
degree of market power is involved and to the extent that the principles concern the 
appropriateness of conditions agreed upon in unbalanced negotiations. It can be 
applied in particular to constitutional principles that protect the right to informational 
self-determination and the fundamental right to data protection. For the same reason, 
the principles of data protection legislation relating to the appropriateness of data use 
must also be directly applied, as they are based on the fundamental right to data 


Federal Ceurt of Justice, judgment cf 7 June 2016, file KZR 6/15, Pechstein, para. 55 (juris) with reference to 
Federal Constituticnal Court 81,242, 255. 

Federal Court of Justice, judgment of 7 June 2016, file KZR 6/15, Pechstein, para. 57 (juris) with reference to 
Federal Constituticnal Court 89, 214, 232. 

Federal Court of Justice, decision of 6 November 1984, KVR 13/83, Favcrit, para. 23 (juris). 

500 See aisc Langen/Bunte/Nothdurft, Section 19 GWB, para. 186ff. 

501 Federal Constituticnal Ceurt, decision of 7 September 2010, file ref. 1 BvR 2160/09, Gasag, para. 34. 

502 Federal Court of Justice, decision of 6 November 2013 - KZR 58/11, VBL Gegenwert /; Federal Court of Justice, 
decision of 24 January 2017 - KZR 47/14 - VBL Gegenwert it. 
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protection under Article 8(2) EU Charter and weigh up the fundamental right to data 
protection against the rights and interests of the data processor. 

530 It is one of the objectives of data protection law to counter power asymmetries between 
organisations and individuals and to carry out an appropriate balancing of the interests 
between data controllers and data subjects.^°^ In order to protect the fundamental right 
to informational self-determination, data protection law provides the individual with the 
right to decide freely and without coercion on the processing of his or her personal data. 
This not only applies to the relationship between the individual and the State ("public 
sector") but also between the individual and private sector companies ("non-public 
sector"). In data-driven industries it is thus the objective of data protection law to protect 
individuals from existing power asymmetries.The design of online offers in the high- 
volume digital business sector increasingly involves decision-making processes which 
the average consumer cannot realistically be expected to be able to deal with. The 
“negotiation processes” between suppliers and users are often asymmetrical 
processes, to the detriment of consumers.In the non-public sector, data protection 
law can therefore be considered as a special economic law as it strives to achieve a 
balancing of interests between data processors and the consumers, i.e. the persons 
affected by the processing of data for business purposes. 

531 In the present case the conditions are to be assessed on the basis of the data protection 
law principles laid down in the General Data Protection Regulation (GDPR)®°® which 
came into force in May 2016 and has taken effect from 25 May 2018 (Art. 99 GDPR). 
The GDPR replaced the previously applicable Data Protection Directive 95/46/EC®°^. 
The relevant provisions of the GDPR are mandatory law which leave the Member 
States only limited scope for their implementation at national level. As a European 
regulation the GDPR is binding in its entirety and directly applicable in all Member 
States pursuant to Article 288(2) sentence 2 TFEU. The GDPR contains some saving 
clauses addressing the Member States and enabling them to adopt national provisions 


Costa-Cabral/Lynskey, "Family ties: the intersection between data protection law and competition in EU law", 
CMLR 2017, 11 (18). 

The case-law rightly considers e.g. Section 4(1) of the German Federal Data Protection Act (BDSG) or Sections 
12, 13 of the German Telemedia Act (TMG) as “a statutory provision which is also intended to regulate market 
conduct" within the meaning of Section 4(11) of the German Act Against Unfair Competition (UWG, old version, 
now Section 3a UWG), as, according to the case-law, the Federal Data Protection Act protects citizens not only 
in their personal sphere as individuals, but also in the same way in their economic activities as consumers. 
Berlin Higher Regional Court, decision of 24 January 2014, para 158 (juris); Berlin Regional Court, decision of 
28 October 2014 (Facebook Onlinespiele), file ref. 16 O 60/13, para 53 (juris). 

Rothmann/Buchner, "Dertypische Facebook-Nutzer zwischen Recht und Realitat", DuD 2018, p. 342 (346). 

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of 
natural persons with regard to the processing of personal data and on the free movement of such data, and 
repealing Directive 95/46/EC. 

50^ Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of 
individuals with regard to the processing of personal data and on the free movement of such data. 
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in individual cases.However, these clauses concern in particular data protection 
rules relating to the processing of data for the purpose of fulfilling a legal obligation or 
public tasks; this is to ensure that sector-specific provisions remain possible in the 
public data protection law of the Member States. These rules are not relevant in the 
present case. A violation of data protection principles can thus be investigated directly 
on the basis of the GDPR.®°® 

532 In view of the balancing of interests in a situation of imbalances of power, terms and 
conditions that violate the legal principles of data protection laws, and also conditions 
that are inappropriate under the legal principles of provisions on unfair contract terms, 
constitute an abuse of a dominant position under Section 19(1) GWB where a sufficient 
degree of market power is involved.Also, both cases share similar characteristics 
due to the fact that most violations of data protection rules, as in the case in question, 
are committed and accompanied by the use of pre-formulated declarations of a 
contracting party (see also 2. below). The practical options private end consumers have 
for becoming aware of the content of the terms and conditions for the collection of data 
and effectively objecting to them do not in principle differ from the practical options 
consumers have under the legal provisions on unfair contract terms. This is a further 
argument in favour of treating the provisions applying to terms and conditions for data 
collection with regard to the application of Section 19 GWB in the same way as was 
already stipulated by the abovementioned case-law of the Federal Court of Justice for 
the legal provisions on unfair contract terms. 

533 The objections raised by the parties, claiming that the provisions on unfair contract 
terms and data protection law are fundamentally different, are not sustainable. 
According to the parties, the differences are essentially based on the fact that data 
processing was not subject to contractual freedom but had to comply with data 
protection legislation, whereas the provisions on unfair contract terms merely limited 
the scope of contractual freedom.This view fails to recognise that data protection 
law does not make any stipulations about the data processing procedures to be carried 
out, but places restrictions on the freedom of the responsible organisation in choosing 
possible data processing procedures, thus achieving a balancing of interests between 
the various data protection principles and the justifications. 


Sydow, Europaische Datenschutzgrundverordnung, 2017, Introduction, para. 45ff.; on the legislative history see 
Ehmann/Selmayr, Datenschutzgrundvererdnung, 2017, Art. 6, para. 30ff. 

509 See also Berlin Higher Regional Court on the assessment under the legal provisions on general terms and 
conditions: judgment of 27 December 2018, 23 U 196/13, p. 5f. [...] 

510 [...] 

511 [...] 
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534 The Federation of German Consumer Organisations (VZBV), which was admitted to 
the proceeding as a third party, is right in pointing out that, according to the case-law, 
data policies also fulfil the elements of general business terms because, from the 
perspective of users, they have a regulatory character.®^^ The ensuing question as to 
the appropriateness of data policies within the framework of the test of reasonableness 
of contents under Section 307(1) and (2) of the German Civil Code (BGB) is based on 
the provisions of the GDPR whose mandatory principles, according to the case-law, 
are directly applicable in this respect as a concept of appropriateness of general 
business terms.®^^ On this basis, abusive business terms pursuant to Section 19(1) 
GWB could also be examined in the present case with respect to a violation of Section 
307 BGB which in turn refers to the mandatory principles of the GDPR. This would be 
the concept used by the Federal Court of Justice for the application of the legal 
provisions on unfair contract terms in the VBL-Gegenwert cases. It is not evident why 
the direct application of the GDPR’s principles within the context of the stipulation of 
Section 19(1) GWB should not be covered by this concept or even be impossible. 

b. Relationship between competition law and data protection law 

535 The application of data protection principles in an assessment under Section 19(1) 
GWB is not inhibited by the European and German data protection laws. The 
Bundeskartellamt’s decision is not in violation of any rules on competence and 
consistency stipulated by the GDPR (see (1), nor does the GDPR contain final, 
substantive provisions with respect to Section 19 GWB (see (2). 

(1) No violation of the rules on competence and consistency 

536 The application of data protection principles in the enforcement of the prohibition of 
abusive practices is first of all not excluded because of the fact that the competition 
authority is not a competent data protection authority pursuant to Sections 55, 56 
GDPR. Contrary to the view held by Facebook®^"^, the Bundeskartellamt does not 
operate to enforce data protection rules as a national data protection officer, but merely 
applies the European law principles as important indications for its assessment under 
competition law of whether the conduct of a dominant company is appropriate.®^® The 

Comment by the VZBV dated 1 January 2019, p. 13, [...]; Berlin Higher Regional Court, judgment of 27 
December 2018, 23 U 196/13, judgment, p. 5, [...] 

Berlin Higher Regional Court, judgment of 27 December 2018, 23 U 196/13, judgment, p. 5f. [...] 

514 [...] 

515 Cf. also the decision of the Italian consumer protection authority AGCM, Bolletino 46/2018 of 10 December 
2018, p. 22ff., httD://www.aacm.it/pubblicazioni^ollettino-settimanale/2018/46/Bollettino-46-2018 : [...] available 
in Italian only , which states in para. 48 (Bundeskartellamt unofficial translation): "And finally the reference made 
by FB to findings of the Irish Data Protection Comm/ss/oner (IDPC) following the examination carried out from 
2011-2012 is completely irrelevant as the IDPC’s examination was carried out on the basis of different legal 
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Bundeskartellamt only considers itself competent to intervene under competition law 
concerning companies which are norm addressees of the German Competition Act’s 
prohibitions of abusive practices. In no way does the authority consider itself competent 
to intervene under data protection law, neither concerning norm addressees of the 
German Competition Act nor concerning any other companies that are subject to the 
GDPR. It is thus irrelevant which data protection authority is locally competent for the 
enforcement of data protection law as a supervisory authority, and whether or not a 
German authority could intervene. 

537 Contrary to Facebook’s opinion, no restriction of the enforcement of the prohibition of 
abusive practices based on data protection law can be seen to arise from the GDPR 
provisions on cooperation and consistency. 

538 According to the GDPR, in the case of companies with several establishments in the 
EU, the supervisory authority of the main establishment is competent to act as lead 
supervisory authority (Art. 56(1) GDPR). The lead supervisory authority shall submit to 
the other competent supervisory authorities its draft decision and give them the 
opportunity to comment. If an authority objects to this draft, the “consistency 
mechanism” under Article 63ff. GDPR will be initiated. The European Data Protection 
Board (a body composed of the Member States’ supervisory authorities, Art. 68 GDPR) 
will adopt a binding decision pursuant to Art. 65(1 a), (2) GDPR by a two-thirds majority 
of the members of the Board. The lead supervisory authority will then have to make the 
final decision as adopted by the Data Protection Board. The consistency mechanism 
for the cooperation between the supervisory authorities is to safeguard the consistent 
application of the law and a consistent level of protection in the supervision of data 
protection. The mechanism is without prejudice to any measures the Commission may 
take in the exercise of its powers under the Treaties, e.g. bringing a matter before the 
Court of Justice of the European Union if a Member State has failed to fulfil an 
obligation under the Treaties (Art. 258 TFEU).^^® 

539 It cannot be concluded from the consistency provisions that authorities have a 
monopoly on the application and interpretation of data protection law.®^^ The 
consistency mechanism is evidently restricted to the cooperation between the 
European data protection authorities which are to safeguard the uniform application of 


norms (data protection rules). This means that there are no “overlapping competences” because the respective 
areas of competence are specific areas and because, in the present case, the authority [AGCM] only 
investigated and penalised the existence of unfair business practices ex-post and in application of the Codice 
del Consumo, without contradicting in any way the findings of the IDPC. The IDPC also stated that the solutions 
[chosen by Facebook] had not eliminated all the critical problems in respect of “user profiling” and that rapid 
technological innovation required a permanent monitoring of the way in which user data are processed.” 

516 Recital 135 GDPR. 

517 [...] 
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the law at a uniform level of protection which had not been achieved within the EU 
despite a previous, fully harmonised data protection standard under the Data Protection 
Directive 95/49/EC®^®. The mechanism is thus to be considered as a measure which 
aims at raising the level of protection, and not at restricting the application and 
interpretation of the data protection law by the European Data Protection Board and 
thus restricting all enforcement activities involved in the protection of data as a 
fundamental right. Neither will the power of the European Data Protection Board to 
develop guidelines be restricted by the application of data protection principles in an 
incidental manner within the context of competition law.®^^ 

540 This can be seen from the fact that direct data protection law enforcement is not limited 
to the supervisory authorities; action can be taken under the civil law without any 
restrictions. This applies to individuals whose fundamental rights as data subjects are 
affected (e.g. Art. 82 GDPR), but also, in particular, to consumer protection 
associations as well as competitors and their associations which can enforce data 
protection based on stipulations of the Act against Unfair Competition (UWG) or 
regulations on business terms under the Civil Code linked to data protection (cf. e.g. 
Section 2(1), (2) sentence 1 no. 11, sentence 2 of the German Act relating to Actions 
for Injunctions in the case of Violations of Consumer Protection Law and other 
Violations, UKlaG). Extensive enforcement action has been and will continue to be 
taken.^2° Most of the ECJ’s case-law that can be found on the already completely 
harmonised data protection law based on Data Protection Directive 95/46/EC has, in 
fact, resulted from civil law actions. The ECJ’s judgment on the “Safe Harbour” 
agreement was based on a private action by the Austrian citizen Maximilian Schrems 
who had lodged a complaint with the Irish Data Protection Comm/ss/oner (hereinafter: 
IDPC) against the transfer of his personal data to the United States and brought an 
action before the High Court. The High Court referred the matter to the ECJ for a 
preliminary ruling.The ECJ’s judgment on the classification of dynamic IP addresses 
as personal data within the meaning of Art. 2 a) and Art. 7 f) Directive 95/46/EC was 
based on an action brought by Patrick Breyer and a request for a preliminary ruling 


ECJ, judgment of 24 November 2011, case C-469/10 and 469/10, joined cases 2011, 1-12181 -12208, para. 1, 
summary. 

[...] 

520 Cf. Annual Report of the Federation of German Consumer Organisations (vzbv) 2017/18, p. 61; VZBV/Facebook 
on account of inadmissible dispatch of friend-finder emails, Berlin Fligher Regional Court , judgment of 24 
January 2014, Federal Court of Justice, judgment of 14 January 2016, Ref. I ZR 65/14; VZBV/Facebook on 
account of inadmissible transfer of data in the use of online games (Berlin District Court, judgment of 28 October 
2014, Ref. 16 O 60/13, Berlin Fligher Regional Court, judgment of 22 September 2017, Ref. 5 U 155/14); 
VZBV/Facebook on account of inadmissible general terms and conditions (Berlin District Court, judgment of 16 
January 2018, Ref. 16 O 341/15); see also Podszun/deToma, Die Durchsetzung des Datenschutzes durch 
Verbraucherrecht, Lauterkeitsrecht und Kartellrecht, Neue Juristische Wochenschrift (NJW) 2016, p. 2987ff. 

5^^ ECJ, judgment of 6 October 2015, Ref. C-362/14 (Safe Flarbour). 
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submitted by the Federal Court of Justice.®^^ Currently a request for a preliminary ruling 
has been submitted to the ECJ by the Dusseldorf Higher Regional Court regarding a 
case involving the question of who is responsible under data protection law for data 
processing triggered by “Like” buttons that are integrated into third-party websites. The 
action had been brought by the VZBV.^^^ 

541 The substantive application of data protection law through competition law stipulations 
does not in any way threaten the consistent interpretation of data protection law, but 
rather promotes consistency. Consistent interpretation is achieved under civil law 
through the successive stages of appeal which, due to the application of European law, 
end up before the ECJ, just as the cases pursued by data protection authorities. The 
ECJ can be requested at an early stage to give a preliminary ruling pursuant to Art. 267 
TFEU. There is no doubt that this type of law enforcement has remained unaffected by 
the GDPR. Furthermore, the guidelines of the European Data Protection Board must 
also comply with the ECJ’s case-law. 

542 In this respect the consistency mechanism for data protection law applicable to 
supervisory authorities is not different from the procedure for the coherent interpretation 
of the European competition rules carried out by the European Competition Network 
(ECN). This procedure, which enables the European Commission to initiate antitrust 
proceedings for the adoption of a decision pursuant to Article 11(6) of Regulation 
1/2003, also does not involve civil proceedings which undoubtedly represent an 
important pillar of competition law enforcement which is characterised by civil law 
relationships. Apart from its competences under the Treaties, the European 
Commission can participate in civil law disputes in the area of competition law as 
amicus curiae. In civil proceedings concerning data protection law cases, there are no 
provisions for such a participation either by the European Data Protection Board or the 
European Commission. The consistency mechanism under the GDPR thus contributes 
to safeguarding the consistent application of the law - a contribution which ultimately 
remains below the framework of possibilities provided by the ECN. 

543 In view of the fact that Section 19 GWB is also one of the direct civil law prohibitions 
which, within the framework of the generally required balancing of interests, must also 
take into account non-competition law principles, in particular mandatory, higher¬ 
ranking constitutional principles including data protection rules, it is not evident why this 
should be treated differently than a civil claim based on the Act Against Unfair 
Competition (UWG) or on stipulations on unfair contract terms under the Civil Code 

522 ECJ, judgment of 19 October 2016, Ref. C-582/14. 

523 Dusseldorf Higher Regional Court, judgment of 19 January 2017, Ref. 1-20 U 40/16; pending before the ECJ 
underC-40/17. 
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(BGB). In particular, it is not evident why, in view of the consistency mechanism, only 
the competition authority should be prevented from applying and interpreting data 
protection law based on Section 19 GWB while civil claims can, in fact, be brought 
based on Section 19 GWB with regard to data protection law.®^"^ 

(2) GDPR does not include any final, substantive provisions 

544 Data protection regulations do not suspend abuse control, which is more specific, 
either. The regulations do not include final provisions regarding dominant companies, 
i.e. they only allow data processing policies by dominant companies to be examined by 
data protection authorities based on the direct data protection regulations, or the 
existing enforcement options under civil law (DWG or legislation on business terms). 
However, this does not include an examination based on the prohibition of abusive 
practices pursuant to Section 19 GWB which applies in particular to dominant 
companies. 

545 Data processing has great relevance for the competitive performance of a company. 
The commercial use of the personal data of customers, users and third parties is a 
significant factor in competition (see above 481 ff.). Businesses therefore strive to gain 
as much information as possible about their (potential) customers in order to improve 
their products, offer personalised services and enable targeted advertising. Digital 
technology has made it possible to analyse particularly large amounts of data from 
different sources and formats as fast as possible.®^® Among other things, this enables 
companies to build customer and interest profiles which are highly relevant for their 
competitive performance. 

546 Under the GWB it is an essential task of the Bundeskartellamt to monitor the 
competitive behaviour of dominant companies and put an end to abusive practices that 
have an effect within the scope of application of the German Competition Act (Section 
185(2) GWB). Under the national as well as the European legal framework there is a 
strong public interest in public enforcement of the prohibition of abuse of a dominant 
position in cases where the practices of dominant companies cause a high degree of 
harm and have wide-reaching effects. 

547 It is evident that the GDPR has neither called into question the competence of 
competition authorities nor the importance of competition law when it comes to the data 


52 ^ [...] 

525 The three terms volume, variety, velocity are predominantly used to describe the characteristics of "big data". 
They stem from a research report by Doug Laney, analyst at Gartner Consulting; see also Monopolies 
Commission, Special Report on "Competition Policy: The challenge of digital markets", 2015, p. 44 with 
further references. 
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processing activities of a dominant company. This cannot be assumed to be the case 
as the data protection law does not include any provision declaring that its rules are 
exhaustive (of. e.g. Section 111 (1) and (2) of the German Energy Industry Act, EnWG). 
Also the data protection authorities have acknowledged the important role of 
competition law enforcement as a reaction to violations of data protection rules. 
According to the resolution of the Conference of Independent Data Protection 
Authorities of the German Federal Government and the Lander (Konferenz der 
unabhangigen Datenschutzbehdrden des Bundes und der Lander), the enforcement of 
data protection law is not the sole response to violations of data protection rules. 
Competition and antitrust law, according to the conference, are also applicable in this 
respect. Even divestiture is mentioned as an option to punish the systematic 
circumvention of data protection for the purpose of gaining anti-competitive advantages 
in the markets.®^® 

548 In his comment on the present proceeding, Hamburg’s Commissioner for Data 
Protection and Freedom of Information emphasises the importance of the prohibition 
of abusive practices under competition law (Bundeskartellamt unofficial translation): 
“Abusive market behaviour which vioiates data protection ruies and ieads to a situation 
where fair competition is no ionger possibie in digitai markets, must be stopped. In this 
respect, data protection and competition law are two sides of the same coin. The 
activities of the Bundeskarteiiamt strive to ensure that it wiii no longer pay off to violate 
data protection rules in order to gain market power. The authority can be sure of the 
support of the Hamburg Commissioner for Data Protection and Freedom of 
Information. 

549 [...p® 

550 In line with this, in Section 18(3a) GWB new version, the German legislator made 
access to such data a stand-alone criterion in the assessment of market power, thus 
expressly emphasizing the relevance of data processing for competition law, and 
pointed out its intention of facilitating abuse control.Particularly for those companies 
which operate a multi-sided market or a network within the meaning of Section 18(3a) 
GWB, there is a direct legislative link between their data processing activities and 
market power within the meaning of the GWB. The market power of a dominant 

Resolution of the Conference of Independent Data Protection Authorities of the German Federal Government 
and the Lander (Kenferenz der unabhangigen Datenschutzbehdrden des Bundes und der Lander, DSK) of 26 
April 2018, “Facebook-Datenskandal - Neues Europaisches Datenschutzrecht bei Sozialen Netzwerken 
durchsetzen!" [...] 

527 [...] 

52B [...] 

529 Cf. legislative intent en the 9th amendment to the GWB with regard to Section 18(3a) no. 4, Bundestag printed 
paper no. 18/10207, p. 51. 



160 


company with a data-driven digital business model provides it with extended data 
processing capabilities which the company will have a high incentive to use, in 
particular with a view to the competitive relevance of user data for advertising funding. 
Also and particularly in this area, abuse control plays a vital and independent role which 
the competition authorities fulfils in line with the provisions of the GWB. 

551 However, the stipulated control of data processing policies cannot mean that, in its task 
of monitoring the scope of data processing, the competition authority should disregard 
the principles of general data protection law and develop its own benchmark or other 
tools instead. This is already impossible in view of the constitutional duty of the 
competition authority to apply the general clauses in such a way that the higher-ranking 
fundamental rights under the ED Charter and the German Basic Law are taken into 
account. The development of other benchmarks or tools would ultimately even 
contravene the GDPR’s efforts to safeguard consistency. As shown by the case-law on 
VBL-Gegenwert, an abuse of a dominant position can be caused by the fact that a 
company did not even comply with the general legal framework. The control of abusive 
practices with respect to the scope for data processing must therefore also include 
compliance with data protection law. 

552 Furthermore, the fact that the GDPR only provides a general legal data protection 
framework applicable in equal measure to all the responsible parties does not mean 
that the market position would be irrelevant in the assessment of its data processing 
policies under the GDPR. In this respect, the question of whether the individuals 
concerned were forced to accept the data processing terms due to a lack of alternative 
offers can play an important role in clarifying whether consent was freely given (cf. Art. 
7(4) in conjunction with Recital 43 GDPR which requires a clear imbalance between 
the controller and the data subject). Moreover, the list of other reasons justifying 
processing in Art. 6 GDPR includes the criterion of necessity and proportionality in view 
of the business purposes and legitimate interests pursued by the company. The 
examination of these reasons must also take into account the market position of the 
data controller.^3° 

553 Conversely, from the fact that data protection law also takes into account the 
examination of a dominant position it cannot be concluded that the dominant position 
would have to be investigated and determined exclusively by the data protection 
authorities. Determining whether market dominance exists is a key element of 
competition law as a part of economic law, and the task of a competition authority which 


Article 29 Data Protection Working Party, Opinion 6/2014 on the notion of legitimate interests of the data 
controller under Article 7 of Directive 95/46/EC, available at https://ec.europa.eu/iustice/article- 
29/documentation/opinion-recommendation/files/2014/wp217 en.pdf (last accessed on 10.01.2019), p. 40, 55. 





161 


has the relevant powers and acts within a differentiated legal and coherence 
framework. Based on the European legal and coherence framework, parallel abuse 
control by the competition authority is necessary and will be carried out in line with the 
data protection rules. 

554 It is therefore not evident that the application of national abuse control by the 
competition authority could be in violation of the principle of sincere cooperation under 
Art. 4(3) TEU.®^^ The rules on competence and consistency have not called into 
question the competence of the competition authority, nor has a final, substantive 
provision been established. There is no obligation for a competition authority not to 
apply competition law in order to have the GDPR provisions become final. 

555 Furthermore, in order to facilitate the application of competition law in this area, the 
German legislator has paved the way for cooperation with the German data protection 
authorities by introducing Section 50c GWB. The Bundeskartellamt conducts the 
proceeding in close coordination with the Hamburg data protection commissioner, a 
competent authority pursuant to Art. 55 ff. GDPR in respect to Facebook’s subsidiary 
in Hamburg. Contact has also been made with the Federal Commissioner for Data 
Protection and Freedom of Information (Bundesbeauftragter fur den Datenschutz und 
die Informationsfreiheit, BfDI) who is the joint representative on the European Data 
Protection Board in accordance with Section 17 of the Federal Data Protection Act 
(BDSG), and with the Belgian data protection authority.[...]^^^ 

556 The Bundeskartellamt has therefore consulted the relevant data protection authorities 
and none of the authorities has objected to the proceeding. These consultations 
eliminated the threat of an allegedly imminent “highly problematic” conflict with the 
enforcement efforts of the originally competent data protection authorities^^^. According 
to the documents on their discussions with the competent data protection authority 
submitted by the parties in response to the Bundeskartellamt’s decision requesting 
information, there was no such threat. 

557 Finally, no concerns can be raised about an alleged lack of expertise of the competition 
authority, as referred to by Facebook. The Bundeskartellamt must take into account 
and apply the general legal frameworks applicable in each sector of the economy. The 
statement that the Bundeskartellamt had incorrectly applied European data protection 


531 [...] 

532 [...] 
[...] 
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law and that Facebook had acted in line with the applicable provisions of data protection 
law, is incorrect.^^'^ 

558 Furthermore, the Bundeskartellamt refers to the numerous proceedings conducted by 
German and European data protection and consumer protection authorities which, inter 
alia, concerned inadmissible processing of data from company-owned services or 
Facebook Business Tools. Hamburg's Commissioner for Data Protection and Freedom 
of Information and also many other European data protection authorities have 
conducted proceedings against Facebook on account of the inadmissible combination 
of WhatsApp data with Facebook.com.Belgian and French data protection officers 
have conducted proceedings against Facebook on account of the inadmissible 
collection of data on third-party websites and their combination with Facebook accounts 
on Facebook.com by means of identifying cookies.®^® On the basis of consumer 
protection law, the Italian competition authority AGCM recently imposed a fine against 
Facebook amounting to 10 million euros on account of aggressive business practices 
by violations of data protection law.®®^ 

2. Data processing terms as (other) contract terms 

559 The relevant provisions on the processing of data collected from Facebook-owned 
services and Facebook Business Tools in Facebook's Terms of Service, Data Policy, 
Cookies Policy and the implementation thereof are to be classified as terms and 
conditions within the meaning of Section 19 GWB. 

560 The location of the specific data processing intended and carried out by the parties in 
the Data Policy or Cookies Policy required for data protection reasons does not mean 
that the feature of the business terms can be superseded (see a.). The provision of 
data does not constitute a "price" within the meaning of the prohibition of anti¬ 
competitive behaviour (see b.). 


53 ^ [...] 

535 Decision of the Hamburg Commissioner for Data Protection and Freedom of Information of 23 September 2016 
(followed up by Hamburg Administrative Court, decision of 24 April 2017, Ref. 13 E 5912/16, and Hamburg 
Higher Administrative Court, decision of 26 February 2018, Ref. 5 Bs 93/17; Decision of the French CNIL of 18 
December 2017, https ://www.cnil.fr/en/data-transfer-whatsaDD-facebook-cnil-publiclv-serves-formal-notice- 
lack-leaal-basis (last accessed on 10 January 2019); Fine imposed on 15 March 2018 by the Spanish data 
protection authority AEDP, see https://www.heise.de/newsticker/melduna/Hoechststrafe-Spanische- 
Datenschuetzer-bitten-Facebook-und-WhatsApp-zur-Kasse-3996469.html (German news report, last accessed 
on 10 January 2019). 

336 Recommendation by the Belgian CBPL of 16 May 2017,judgment of the Brussels Court of First Instance 
of 16 February 2018, [...]; fine proceedings of the French CNIL, see press release of 16 May 2017, 
https://www.cnil.fr/en/facebook-sanctioned-several-breaches-french-data-protection-act (last accessed on 
10.01.2019). 

337 AGCM, Bolletino 46/2018 of 10 December 2018, p. 22ff., http://www.aacm.it/pubblicazioni/bollettino- 
settimanale/2018/46/Bollettino-46-2018 ;[...] (available in Italian only). 
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a. Data policies as part of the Terms of Service 

561 Contrary to Facebook's view, the Terms of Service in conjunction with the Data Policy 
and Cookies Policy are indeed terms and conditions as defined by Section 19 GWB. 
The explanations in the Data and Cookie Directive specify Paragraph 2 of the Terms 
of Use. The requirement of transparency under data protection law, which obliges the 
parties to provide information on their data processing by issuing a data policy, does 
not alter the nature of the business terms. 

562 The antitrust term “business term”, as used in Section 19(1), (2) nos. 2 and 3 GWB, for 
instance, needs to be interpreted broadly in order to make the entire supplier-customer 
relationship, which is characterised by an imbalance of power, subject to the prohibition 
of abuse in addition to pricing.^^® As such, with regard to the market quality of the 
relationship between Facebook and the users of Facebook.com (para. 239ff. above), 
the following needs to be taken into consideration, namely that it can certainly be 
assumed that a “business” relationship exists. 

563 Business terms must first include the expressly regulated terms and conditions which 
customers must consent to and which are therefore the subject of the contractual 
arrangement. They include the factual terms and conditions which are carried out 
without the customers’ consent. Business terms also include any actual transactions 
that may be the subject matter of a contractual arrangement.®^^ 

564 Contrary to Facebook’s opinion,the data processing procedures at issue are all part 
of the contractual arrangement, since users must agree to the Terms of Service before 
they can use the service (see above para. 88). For the Terms of Service indicate the 
following in Paragraph 2 under the heading “Our Data Policy and your privacy settings" 
(above para. 94): “We collect and use your personal data in order to provide the 
services described above to you. You can learn about how we collect and use your 
data in our Data Policy [hyperlink]. [...]“ Jh\s means the Terms of Service themselves 
contain a completely unrestricted regulation for the processing of each user's personal 
data which users have to agree to. According to Paragraph 5, these terms make up the 
entire agreement between the users and Facebook Ireland Limited regarding the use 
of Facebook Products. The processing of personal data is therefore, according to 
Facebook’s own Terms of Service, expressly part of the agreement and is therefore 
the subject matter of the agreement. Whether this consent is deemed consent under 


cf. the concept of business terms (in German) Langen/Bunte-Nothdurft, Section 19 GWB, para. 142 

539 Cf. Beohtoid, GWB, 8th edition. Section 19, para. 53; Langen/Bunte-Nothdurft, Section 19 GWB, para. 142 

540 j- j 



164 


data protection law and can provide a sufficient legal basis is irrelevant for the 
contractual inclusion of the Terms of Service for data processing. 

565 The Data Policy is expressly referred to in Paragraph 2 and, together with the Cookies 
Policy, to which the Data Policy refers, therefore sets out the concrete terms of use 
with regard to the processing of personal data. In any case, the Data Policy and 
Cookies Policy have become part of the contract due to the refererence in Paragraph 
2 Terms of Service as they specify the Terms of Service governing the processing of 
personal data. In addition, the Data Policy and Cookies Policy themselves have 
regulatory character because from the customer's viewpoint they contain binding 
provisions that are supposed to correspond to the conclusion of the contract.^'^^ This 
also applies in view of the fact that, under the heading “What is our legal basis for 
processing data?’ the parties rely to a large extent on the fulfilment of the Terms of 
Service in the Data Policy and invoke performance of the contract as the legal basis. 
Yet the question of the regulatory nature of the contract is not determined by whether 
or not it is a permissible legal basis under data protection law. This is because from the 
users' point of view, which is the only perspective relevant in this context, these 
provisions lay down a contractual meaning if not a contractual obligation that is imposed 
unilaterally, just like the rest of the content of the contract. 

566 The open wording of the Data Policy and Cookies Policy must therefore also be taken 
into account as part of the contractual terms. The objection raised by the parties that 
the wording of the policies ensues from the obligation under data protection law to 
transmit the information in a concise, transparent, intelligible and easily accessible 
form, using clear and plain language®'^^, is not convincing. However, this open wording 
is also used in particular with regard to the processing of data from Facebook-owned 
services and Facebook Business Tools. In this respect, the related policies each use 
the same open stipulation that data is processed across all Facebook Products and 
Companies. A limitation of the data record and the intended use can only be found in 
the WhatsApp FAQs. 

567 Additionally, it is therefore quite common to clarify in the data policies, for instance, 
which data is not processed for what purposes, assuming any such restriction exists in 
the first place. The WhatsApp policy states in one place for instance that the contents 
of encrypted messages are not read. The alleged limited actual data processing which 
is not specifically substantiated at any stage is not reflected in Facebook's Terms of 
Service. From the user's perspective, Facebook's Data Policy and Cookies Policy 

cf. judgment of Higher Regional Court of 27 December 2018, 23 U 196/13, copy of the judgment, p. 5f., [...] For 
this reason, they need to be classified as general terms and conditions. 

5^2 [...] 
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therefore allow for virtually unlimited data processing from sources outside the social 
network. The vagueness of the wording also implies that Facebook at the very least 
intends to process data from third-party sources. The fact that Facebook uses a data- 
driven business model is common knowledge and is acknowledged by the company 
itself. In this respect, extensive use of existing data is economically expedient and 
commercially reasonable and is expected to be predictable at least for the future®"^^, 
especially if a contractual basis for it has been created. 

568 The transparency requirement under data protection law that obliges the data controller 
to provide the data subject with information about data processing pursuant to Article 
12(1), Article 13 and Article 14 GDPR does not mean the Data Policy and Cookies 
Policy cannot be classified as business terms.®"^"^ This obligation does not mean that 
the policies would only have purely informative character which would exclude the 
quality of contractual regulation. General terms and conditions of business are also 
subject to a transparency requirement pursuant to Article 307 para. 1 sentence 2 of the 
German Civil Code (Burgerliches Gesetzbuch). The Bundeskartellamt takes into 
account the informative nature of the Data Policy and Cookies Policy, including those 
of Facebook-owned services, to the extent that they document how data processing 
terms are actually implemented. In that regard, contrary to the view taken by the parties, 
the actual processing of the data is also the focus of investigation, although it is not 
limited to that. 

b. No price within the meaning of antitrust iaw 

569 The possible fee-like function of providing data does not mean that the data processing 
terms are to be regarded as prices within the meaning of Section 19(2) nos. 2 and 3 
GWB. 

570 From the company's point of view, data processing has a monetisation and indirect 
financing function, and data are generally perceived as a kind of "currency" on the 
Internet. From the Facebook users' point of view, however, the impression remains that 
the service is free of charge and it says precisely this in a Facebook advertising slogan 
("Facebook is and will remain free of charge"). When paying for a specific service, 
consumers have a clear idea of how much they are spending and they can influence 
the costs they incur by adapting their demand behaviour according to the limits of their 
budget. When it comes to handing over their data, the situation is completely different. 


cf. for instance, Federal Court of Justice of 8 May 2001, KVR 12/99, WuW/E DE-R 711, 717 - Ost-Fleisch; 
judgment of 29 October 1985, KVR 1/84, WuW Federal Court of Justice 2211,2218 - Morhs-Rothmans. 
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571 Personal data represent an unlimited commodity that is not used up by sharing and 
even consumers on a limited budget do not need to determine how much they are 
willing to pay. Rather, the main problem - similar to terms and general terms and 
conditions - is that when consumers share their personal data, they are not really able 
to judge which and how many data are being collected by which company, to whom 
their data is being transmitted and what the implications of giving consent to data 
processing are. As the investigations in the present case show, the large number of 
conditions and provisions governing data processing regularly involved in the massive 
use of personal data means private users are hardly aware, if not fully unaware, of the 
individual provisions, as is typical of pre-formulated general terms and conditions 
dictated by the provider.^'^^ 

572 These characteristics justify the examination of inappropriate agreements and 
provisions on data processing by the dominant undertaking under the aspect of abusive 
business terms. In addition, the new provisions of Section 18(2a) GWB state that the 
assumption of a market is not invalidated by the fact that a good or service is provided 
free of charge. Otherwise, there would have been no need to clarify that a market within 
the meaning of the law is still a market even if a service is provided “free of charge”. 
According to the explanatory memorandum, business models such as the one at issue 
here are precisely what provided the background to the regulation.^'^® The genesis and 
terminology of the new regulation thus confirm the outcome that provisions governing 
data sharing are not regulations governing payment within the meaning of Section 
19(1), (2), nos. 2 and 3 GWB, but rather contractual terms. 

3. Violation of GDPR data protection values 

573 The data processing from other Facebook-owned services and from Facebook 
Business Tools, which is imposed by Facebook and is presented in detail in the 
operative part of the decision, breaches European data protection values pursuant to 
GDPR. For, the collection of user and device-related data and combining these data 
by assigning them to the respective Facebook user accounts and the use of this 
information actually involves the processing of personal data including special data 
categories and profiling (see a.). Facebook is responsible for the imposed processing 
of personal data under data protection law (see b.) There is no sufficient justification 
pursuant to Article 6(1), Article 9 (2) GDPR (see c.) for the imposed processing of data 
from Facebook-owned services or Facebook Business Tools. 


545 |- ] 

Legislative intent of the 9th Amendment to the German Competition Act 2017, Bundestag printed paper 
18/10207, p. 47f. 
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a. Processing of special categories of personal data and profiling (Articles 4 and 
9 GDPR) 

574 Both the user and device-related data from other Facebook-owned services and from 
Facebook Business Tools are personal data within the meaning of Article 4 GDPR (see 
(1). This includes special categories within the meaning of Article 9(1) GDPR (see (2). 
The "recording", "combination" and "use" of the data provided for and carried out in the 
Data Policy fulfil the definition of procedures defined as "data processing" in Article 4(2) 
GDPR and include the "profiling" defined as "data processing" in Article 4(4) GDPR 
(see (3). 

(1) Personal data 

575 All user- and device-related data described and actually processed in the Data Policy 
comprise information relating to identified or identifiable natural persons pursuant to 
Article 4 para. 1 GDPR. According to this provision an identifiable natural person is one 
who can be identified, directly or indirectly, in particular by reference to an identifier 
such as a name, an identification number, location data, an online identifier or to one 
or more factors specific to the physical, physiological, genetic, mental, economic, 
cultural or social identity of that natural person. 

576 All data that Facebook processes from its own services or from Facebook Business 
Tools designated in the operative part of the decision therefore comprise personal data 
because Facebook can and actually does assign them to Facebook user accounts and 
combines this data within the framework of the social network. In order to create a 
Facebook account, users have to provide at least their first and last name, their 
birthday, gender, mobile phone number or e-mail address. Users are given a Facebook 
user ID when they create a Facebook account. When using Facebook.com, users 
disclose a large amount of other personal information. The data processed from other 
sources can be assigned to these identifying data, so that each user- and device- 
related data can also be classified as personal data. 

577 "User-related data" can be categorised as information which, according to its content, 
refers directly to the person, such as identity, interests, living conditions, 
communication content or the user's behaviour. "Device-related data" can be defined 
as technical data in the broadest sense relating to the terminal devices used by the 
user as well as to the software and other content stored on these devices. This "device- 
related data" can indirectly reveal information about the user, such as location-related 
information, physical movements which are generated via the positioning data or 
mobile device sensors, creating a user movement profile. 
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578 In addition, device-related information in particular plays a very important role for user 
identification and the individual assignment of data collected. This includes, for 
instance, the unique device information such as the advertising ID, MAC address or 
the IMEI (International Mobile Equipment Identity) of the mobile device. Further 
information on the devices used by users, the software installed on them and technical 
configurations, including browser information, can also be used to identify the 
respective users on the basis of their unique device configuration. Facebook [...] uses 
metadata to assign the data to Facebook users.^'*^ This is also indicated in the Cookies 
Policy. It says that Facebook uses other technologies, including data it stores on users’ 
web browser or device, identifiers associated with users’ device, and other software, 
for similar purposes as cookies. 

579 The device-related data collected in particular facilitate the process of so-called 
"browser fingerprinting" or "device fingerprinting". As such, a distinction is made 
between passive and active fingerprinting. Passive fingerprinting involves the reading 
of information that is transmitted when a website is accessed via the technical protocols 
used. This includes the browser type, browser version, browser settings, IP address, if 
applicable the manufacturer and type designation of the smartphone, tablet or other 
mobile device. Active fingerprinting involves a program code which is executed directly 
on the device. Information can be read specifically, for instance, via JavaScript. This 
allows a variety of other pieces of device-related information, such as screen resolution, 
time zone, system colours, plugin versions, installed fonts, languages, processor cores, 
window size and much more to be captured. 

580 The information is stored on the Facebook server when users visit the website, and is 
then captured again the next time the page is accessed and is matched with the stored 
data - the fingerprint. Owing to the large number of individual users’ setting options that 
can be customised, the fingerprint allows the user to be identified with considerable 
accuracy. A unique user profile is created by combining these different pieces of 
information. The more information there is available and the more individual the 
settings are, the more accurately unambiguous identification can be achieved. This 
explains how a user can be identified even if the fingerprint has been slightly modified 
in the meantime. According to a scientific test conducted by Lehigh University 
Pennsylvania/USA, users can be identified with a reliability of 99.24% via browser or 
device fingerprinting, without having to resort to IP addresses, cookies or similar 
techniques. 


5^7 [...] 

https://www.heise.de/newsticker/melduna/Web-Browser-Finaerprintina-Erkennbar-auch-ohne-Cookie- 

3597078.htmi (in German, iast accessed on 10 January 2019). 
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581 Facebook also collects and stores this identifying information when Facebook.com is 
used. The data collected from other Facebook-owned services and from Facebook 
Business Tools can then be matched with the data already assigned to the Facebook 
user account in question. There are a number of ways in which data can be assigned. 
If the data source is a third-party website, a cookie set by Facebook containing the 
Facebook user ID or other information uniquely associated with the user can be 
transmitted when the website is accessed. If the website has Facebook Business Tools 
embedded, the user information collected can be assigned by passive or active 
fingerprinting based on the browser and device information. This applies in particular 
to the tools executed by default via JavaScript SDKs, which are directly installed on the 
respective (third-party) app on the terminal device. The Facebook pixel is also a 
JavaScript code that can capture a large amount of information about website visitors 
and their devices. 

582 In addition, a (hashed) data record with identifying characteristics ("identifiers") can be 
sent from the website via the pixel by way of "Advanced Matching" if no cookie has 
been set. Facebook also recommends the websites to use "Advanced Matching", which 
involves direct transmission of the e-mail address, telephone number, first name, 
surname, city, state, zip code, gender and date of birth that the website receives, for 
instance when users log in, register or shop online. In this regard, Facebook expressly 
points out that this allows more activity on the website to be matched with Facebook 
users, even if no cookies have been set.^'^® As with the other interfaces, Facebook 
reserves the right to analyse the data from third-party pages/apps for "any purpose, 
including commercial purposes" in respect of the information transmitted about user 
behaviour on the websites or apps associated with the hashed data.®®° 

583 Due to the multitude of data and the possibility of assigning data to Facebook user 
accounts using a unique identification number, ID or device fingerprint, the data on the 
use of the third-party website or app including the various configuration data, therefore 
always refers to a "specific" or "identified" person within the meaning of Article 4 (1) 
GDPR regardless of the meaning and content of the individual pieces of information. 


Cf. https://developers.facebook.com/docs/facebook-pixel/advanced/advanced-matching, [...] 

550 see Paragraph 6.1 to 3 of Facebook Platform Policy, https://developers.facebook.com/policv/: “Things you 
should know: 6.1: We can analyze your app, website, content, and data for any purpose, including commercial”, 
6.2: We can monitor or collect data related to your use of SDKs; 6.3: We will use information we receive from 
you or in connection with your Platform integration pursuant to our Data Policy. [...] 
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(2) Special data categories 

584 The processing of data collected from Facebook-owned services and Facebook 
Business Tools imposed by Facebook also includes without distinction special data 
categories pursuant to Article 9 (1) GDPR. 

585 The special categories of data within the meaning of Article 9 (1) GDPR include all data 
revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or 
trade union membership, as well as genetic data, biometric data, health data or data 
relating to an individual's sex life or sexual orientation. 

586 Contrary to Facebook's view, it is sufficient for the sensitivity of data arising from the 
information collected for it to qualify as a "special data category". It cannot be assumed 
that this information is merely information from which sensitive information might be 
derived and that this is not sufficient for it to be classified as sensitive information.At 
the latest when the information about the page visited is assigned to a Facebook user 
account do sensitive data arise as a special data category, since it can be clearly 
assigned to a natural person. In accordance with the wording of Article 9 (1) GDPR, it 
is sufficient for classification as a special data category that data “reveal” a certain 
property. This does not mean that the data itself must reveal the characteristic. It is 
sufficient for the content of the data to at least indirectly reveal the mentioned 
characteristic to an average, objective third party.^^^ The prohibition thus concerns the 
starting date that can reveal the above-mentioned characteristics through processing 
and, if applicable, interpretation.^^^ 

587 The collection of data on third-party websites and apps can easily generate data on 
racial and ethnic origin, political opinions or ideological convictions. Through the mass 
integration of Facebook Business Tools and APIs such as social plugins, Facebook 
Login or the Facebook pixel, Facebook collects data that identify specific 
characteristics of the user. The flirting app "Tinder", for instance, offers a Facebook 
login and the homosexual partner exchange "Queer" (www.queer.de) has an integrated 
“Share” on Facebook button. Even political parties such as CDU, SPD, Linke and AfD 
and healthcare websites such as www.onmeda.de or www.netdoctor.de have 
integrated “Share” on Facebook buttons. This enables Facebook, which has further 


551 [...] 

552 Ehmann/Selmayr, GDPR, Art. 9 GDPR, para. 10 with further references; “Does Article 9 GDPR rule out the 
permissibility of processing with big data?” (“SchlieUt Art. 9 DSGVO die Zulassigkeit der Verarbeitung bei Big 
Data aus”?), ZD 2017, p. 303 (305). 

553 Schneider, “Schlielit Art. 9 DSGVO die Zulassigkeit der Verarbeitung von Big Data aus?“, ZD 2017, p. 303 
(304); Data Protection Committee guidelines on automated case-by-case decisions including profiling for the 
purposes of Regulation 2016/679 most recently amended and adopted on 6 February 2018, p. 16, 17, available 
at http://ec.europa.eu/newsroom/article29/item-detail.cfm7item id=612053 . (last accessed on 10 January 2019) 
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information about the user based on its existing data record, to create detailed profiles 
also using sensitive user data. 

588 Contrary to Facebook's view, this does not involve objectively neutral data that only 
become special data categories if they are combined with the other data available on 
Facebook but which, regardless of whether they are combined or not, can be inferred 
indirectly as sensitive data. The view of the UK data protection authority ICO 
(Information Commissioner’s Office) which Facebook refers to, on the other hand, 
deals only with information that "may allow special categories of personal data to be 
derived as a potential option". 

(3) Data processing including profiling pursuant to Article (4) GDPR 

589 After all, "recording", "combining", and “using" means data processing within the 
meaning of Article 4 (2) GDPR (see (a), which also includes profiling pursuant to Article 
4 (4) GDPR (see (b). 

(a) Relevant data processing procedures pursuant to Article 4 (2) GDPR 

590 The conditions set out in detail in the operative part of the decision and their 
implementation relate to different data processing procedures and phases within the 
meaning of Article 4 (2) GDPR, which are summarised in the categories "recording", 
"combining" and "using" as the essential processing phases. 

591 Facebook uses the general terms of "recording", "combining" and "using" in the 
conditions at issue here. These broadly conceived terms facilitate a very wide range of 
data processing procedures, each of which fulfils the definition of data processing 
pursuant to Article 4 (2) GDPR. For Article 4 (2) GDPR says the generic term “data 
processing” means any operation or set of operations which is performed on personal 
data or on sets of personal data, whether or not by automated means. This includes 
collection, recording, organisation, structuring, storage, adaptation or alteration, 
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise 
making available, alignment or combination, restriction, erasure or destruction. 

592 The "recording" of data collected from other Facebook Companies and from Facebook 
Business Tools refers to the data processing procedures associated with the receipt of 
data from Facebook Companies or via Facebook Business Tools from third parties by 
the operating company. At the very least, it encompasses collection, recording, 
organisation, structuring, storage, adaptation or alteration, retrieval, consultation and if 


554 


[...] 
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applicable, also the matching of the data, in order to examine the usefulness of the 
data. As regards Instagram, there is no need for Facebook.com’s operating company 
to “receive” user and device-related data as Instagram is meanwhile being provided by 
the same operating company. 

593 In addition, the "combining" of data mentioned in Facebook's Terms of Service is to be 
construed within the meaning of Article 4 (2) GDPR as "combining" data, which includes 
in particular assigning the available data from the sources outside Facebook.com to 
the respective Facebook user accounts via the Facebook ID. Matching data from the 
above-mentioned sources with the existing data in order to find the Facebook account 
of the respective user via the various matching options and assigning in particular the 
Facebook ID, is a key procedure that represents the combining and permanent 
combination of data. 

594 This is based on Facebook's claim that the company does not create "profiles" within 
the meaning of individual data records, which are each expanded by adding data.®®® 
Rather, based on the current database structure, the individual data are provided with 
the Facebook ID after the above-mentioned device-related data in particular has been 
matched such as the so-called Family Device ID or other characteristics of the devices, 
have been stored throughout the entire database and are, if necessary, retrieved for a 
specific purpose during its implementation, depending on the task of the algorithm. 

595 The "use" of the data involves the use of the data for the purposes pursued in each 
case. In this respect, Facebook mentions a variety of purposes such as the 
personalisation of services, advertisements, security purposes and research. 
According to Facebook's Terms of Service, "use" is defined as any use of data collected 
from other Facebook Companies and from Facebook Business Tools by the operating 
company of Facebook.com. 

596 Each of these processing steps requires a legal basis pursuant to Article 6 (1) and 
Article 9 GDPR. The extension of the catalogue of processing procedures in Article 4 
(2) GDPR vis-a-vis Article 2 (b) Directive 46/95/EC has not brought about any changes 
in the legal situation. The definition of processing in Article 4 (2) GDPR also covers the 
individual processing phases, which are subject to a prohibition with reservation of 
consent.®®® 


555 |- ] 

Auernhammer, GDPR, Art. 4 para. 18; Ehmann/Selmayr, GDPR, Art. 6, para. 1. 



173 


(b) Profiling, Article 4 (4) GDPR 

597 The use of the data imposed consists of "profiling" in accordance with Art. 4 No. 4 
GDPR, in particular with regard to personalisation and advertising purposes. Facebook 
processes all personal data, including data generated from Facebook-owned services 
and Facebook Business Tools, by combining them with the data collected when the 
social network is used in order to analyse or predict personal aspects relating to a 
natural person. This also includes aspects concerning that natural person’s 
performance at work, economic situation, health, personal preferences, interests, 
reliability, behaviour, location or movements. In general, according to the guidelines 
issued by the Article 29 Data Protection Working Party adopted by the European Data 
Protection Board, profiling refers to the gathering of information about an individual (or 
group of individuals) and the evaluation of their characteristics or patterns of behaviour 
for the purpose of dividing them into a particular category or group, in particular for 
analysis and/or forecasting in relation to their ability to perform a task, interests or likely 
behaviour.^^^ As such, the data collected are also automatically analysed and 
correlations are identified which are applied to an individual for the purpose of 
identifying characteristics of current or future behaviour. 

598 This demonstrates that Facebook carries out detailed profiling on the basis of a large 
volume of data on a variety of personal aspects for the purposes of personalising the 
service and for customising (targeting) advertising. 

599 As indicated above, Facebook's News Feed in particular is created and individualised 
using a relevance algorithm. News Feed is a personalised stream of content and 
activities relating to the user. For an optimum user experience, the aim is for users to 
see content most relevant to them when News Feed is displayed. The algorithm 
calculates individually for each individual user in particular on the basis of the 
influencing factors "Affinity", "Weight" and "Expiry" a value for any post for the News 
Feed that has a positive or negative impact on the supposed relevance of a post. This 
is the basis on which the contents of each user’s personal News Feed is sorted. 
“Affinity” is determined based on interaction with the respective users and their posts. 
Indicators include contact in the form of posts to the chronicle, pages liked, comments, 
mutual tags, visits to websites, etc. Overlapping user interests, friends and action 
patterns are also relevant. The basis of the "Weight" assessment is the interaction of 
others (friends or third parties) with the post in the form of clicks, like tags, shared 
content, comments and even the contents of the interactions. Personal factors such as 


cf. Guidelines on automated decisions in individual cases including profiling for the purposes of Regulation 
2016/679 of 3 October 2017, most recently amended and adopted on 6 February 2018, p. 7; [...] 
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the relevance of the individuals who interacted with the post play a role as well as the 
click/likes/share quotas. It is also taken into account for the expiry period, however, 
whether a post is only interesting in the present situation or whether it will continue to 
be relevant in the long term. This is assessed, for instance by looking at the reaction to 
the post (short-term and intensive or long-term and constant). The type of content is 
also important, e.g. whether the post consists of an image, video, text, link, etc. If users 
can be observed to react intensively to images, but rarely click on links, images seem 
to be more interesting to them and will be ranked higher. 

600 Facebook also performs profiling for the purposes of targeted advertising. In the 
advertising manager, as described above, target groups are formed on the basis of 
detailed personal characteristics and preferences according to location, age, gender 
and language as well as according to further demographic data, interests and 
behaviour, evaluating the user data. The location can be further specified based on the 
following criteria: “Everyone in this location”, “People who live in this location”, “People 
recently in this location”, “People travelling in this location”. Age can be specified by 
exact age categories, with 13 being the minimum age and 65-i- being the highest age 
category. The following subcategories are available for demographic data: “Education", 
“Financial”, “Generation”, “Home”, “Life Events”, “Parents”, “Politics", ..Relationship”. 
“Interests” are further specified as “Business and Industry”. “Shopping and fashion”. 
“Food and drink”. “Family and relationships”. “Fitness and wellness”. “Hobbies and 
activities”. “Sports and outdoors”. “Technology”, and “Entertainment”. “Behaviours” are 
categorised as “Automotive”. “Digital activities”. “Financial”. “Anniversary”. “Purchase 
behaviour”. “Consumer classification”. “Multicultural affinity”. “Mobile device user”. 
“Travel”. “Residential profiles”. “Seasonal and events”. “Home owners”, etc. Tailor- 
made target groups are put together, including "lookalike" target groups, for which 
certain detailed aspects are again decisive. 

601 It is also expressly stated in the Facebook Data Policy that data collected from other 
Facebook-owned services and Facebook Business Tools may be used for the 
purposes of profiling and may be assigned to the respective Facebook accounts when 
data are combined. It says that the information obtained from these sources is used to 
personalise features and content and make suggestions for users on and off the 
Facebook Products (e.g. groups or events users may be interested in or topics they 
may wish to follow). Facebook states that it uses the connections, preferences, 
interests and activities to create personalised products that are unique and relevant to 
users. Based on the data it collects on them and others including any data with special 
protections they choose to provide to which they have given their explicit consent and 
“how they use and interact with the Facebook Products, and the peopie, pieces or 
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things they are connected to and interested in on and off the Facebook Products .In 
relation to "information across different Facebook Products and devices" Facebook 
explains; “We connect information about your activities on different Facebook Products 
and devices to provide a more taiiored and consistent experience on aii Facebook 
Products that you use, wherever you use them. For exampie, we can suggest that you 
join a group on Facebook that inciudes peopie you foiiow on instagram or communicate 
with using Messenger... Facebook also indicates in relation to ads that it uses “the 
information we have about you” - including information about “your interests, actions 
and connections” - to select and personalise ads. 

602 In this respect, Facebook's Terms of Service and Data Policy do not make any 
distinction whatsoever between the individual sources of data even with regard to the 
purpose of personalisation. According to this information, the Facebook Products 
include Facebook (including the Facebook mobile app and in-app browser), 
Messenger, Instagram (including apps like Direct and Boomerang), tbh, Moments, 
Bonfire, Facebook Mentions, AR Studio, Audience Network, and any other features, 
apps, technologies, software, products, or services offered by Facebook Inc. or 
Facebook Ireland Limited. The Facebook Products also include Facebook Business 
Tools such as plugins (for example “Like” and “Share” buttons) and the SDKs and APIs, 
used by website owners and publishers, app developers, business partners (including 
advertisers) and their customers to support business services and share information 
with Facebook. 

603 In addition, the "Facebook Companies" are mentioned without distinction, including 
Facebook Payments Inc., Onavo, Oculus, WhatsApp, Masquerade and CrowdTangle. 
Facebook’s Data Policy states “that it processes information about users across the 
Facebook Companies to provide an innovative, reievant, consistent and safe 
experience across aii Facebook Company Products”. 

604 The Bundeskartellamt assumes that the information collected by WhatsApp is not 
currently being used for profiling purposes on Facebook. However, Facebook's Terms 
of Service do not seem to contain any limitation similar to that outlined in WhatsApp 
FAQs regarding WhatsApp data and any information can only be found via several links 
to WhatsApp’s Help Centre. It must therefore be assumed that Facebook continues to 
reserve this right vis-a-vis Facebook users and that this is also the subject matter of 
the contractual terms. 


cf. Facebook’s Data Policy of 19 April 2018 under heading II. “How do we use this information”? [...] 
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b. Responsibility for data processing 

605 Facebook and Facebook Ireland Ltd. are "responsible" under data protection law for 
the processing of data generated from Facebook-owned services and Facebook 
Business Tools described in detail above (Article 4 (7) GDPR) and are therefore 
responsible for compliance with the principles governing the processing of personal 
data (Article 5(2) GDPR), as Facebook alone or jointly with others decides why and 
how personal data are processed. 

606 Facebook cannot invoke group privileges (see (1)) for the processing of data generated 
from Facebook-owned services WhatsApp, Oculus, Masquerade, and Instagram 
services, or any other Facebook-owned services for that matter. 

607 Facebook is at the very least jointly responsible for the processing of data generated 
from access to third-party services via Business Tools and other interfaces (Articles 24 
and 26 GDPR). This does not involve processing of data on behalf of the controller 
within the meaning of Article 4(8) GDPR as far as individual services are concerned 
(see (2)). 

(1) Group privilege does not apply 

608 With regard to the processing of data collected by other Facebook Companies for their 
services, such as WhatsApp, Oculus, and Masquerade in particular, the company 
operating Facebook.com in Europe - Facebook Ireland Ltd. - has a separate 
responsibility under data protection law for the transfer of personal data of users 
resident in Germany and their assignment to the respective Facebook user accounts 
as well as for the further use and other processing of the data for the purposes of 
Facebook.com. These data processing procedures are also subject in each case to the 
data protection principles including the lawfulness of processing pursuant to Article 6(1) 
GDPR. Facebook cannot therefore invoke any justification for data processing by 
Facebook Companies. 

609 On the contrary, Facebook Companies are deemed to be separate responsible entities. 
This ensues from Article 4(7) GDPR, according to which the legal person is regarded 
as the responsible party, so that the respective companies belonging to the group 
remain responsible for data processing and are therefore to be regarded as third parties 
in relation to each other. The GDPR does not make any provision for group privileges. 
The exchange of data between companies belonging to the same group is therefore 
not permitted just because the companies involved are affiliated. Each company must 
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continue to be regarded as a separate entity under data protection law, with the result 
that data transfers within the group must also be justified in each case.^^® 

610 The GDPR does define a term “group of undertakings” in Article 4(19) GDPR. 
According to Recital 48, controllers that are part of a group of undertakings or 
institutions affiliated to a central body may have a legitimate interest in transmitting 
personal data within the group of undertakings for “internal administrative purposes”, 
including the processing of clients' or employees' personal data. However, Recital 48 
itself does not provide a legal basis for the transmission of data. On the contrary, this 
regulation refers to the balancing of interests in the assessment of the lawfulness of 
data processing, as it needs to be carried out in particular pursuant to Article 6(1) 
sentence If) GDPR.®®° This shows that even data flows within group undertakings 
require justification and the companies must be regarded as third parties vis-a-vis one 
another in each case. 

611 This means each company belonging to the Facebook Group is responsible for the 
processing of personal data. This is also justified from the users' perspective, since 
some users of a service provided by a company belonging to the Facebook Group may 
not even be aware that the service is part of the Group. Furthermore, the possibility of 
combining different data sources enables the processed data to achieve a different 
data quality, which also means a different quality of invasion into the privacy of the 
individual and therefore requires independent justification. 

612 Contrary to Facebook’s view^®\ no group privilege can be derived from Section 36(2) 
GWB in this particular case. Even though Section 19 GWB provides the legal basis for 
the assessment, the proportionality of data processing depends first and foremost on 
the principles governing data protection law. However, Section 36(2) GWB has no 
bearing on the question of the proportionality and admissibility of data processing under 
data protection law. 

613 The judgment handed down by the Federal Court of Justice in the Entega case®®® 
cannot be transferred to this particular case either. The proceedings instituted against 
Entega for abusive pricing specifically involved a price split pursuant to Section 19(2) 
no. 3 GWB (Section 19(4) no. 3 GWB old). Here, too, the very fact that pricing can be 
strategically aligned by companies belonging to the group shows that they should be 
considered to be a single entity. Section 19(2) no. 3 GWB would be meaningless if 


Plath, GDPR, Article. 6 GDPR, para. 77 

Voigt, ’’Konzerninterner Datentransfer - Praxisanleitung zur Schaffung eines Konzernprivilegs", (available in 
German only) CR 2017, 428 (429). 

561 [...] 

562 [...] Federal Court of Justice, judgment dated 7 December 2010, “Entega", KZR4/10, para. 17 (iuris). 
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Section 36(2) GWB did not apply since the dominant company could arbitrarily use 
legally independent subsidiaries to enforce the price split.^®^ No group privilege was 
assumed here either. Moreover, intra-group transactions are not generally exempt from 
abuse control if they have restrictive effects on competition. This applies, for instance 
to the classic cases of bundling products within the same group resulting in the transfer 
of market power or exploitation of the opposite side of the market.^®'* Facebook's view 
that group privileges are recognised fully and unanimously in antitrust law®®®, is 
therefore incorrect. 

614 This means that in view of the Facebook Group’s current structure, it is assumed that 
Facebook Ireland Ltd. has an independent data protection responsibility for the 
recording, combining and use of user and device-related data by WhatsApp Ireland 
Ltd. and WhatsApp Inc., Masquerade Technologies Inc. and Oculus VR, LLC. 
respectively, with the accounts of the online services Facebook.com operated by 
Facebook Ireland Ltd. at Facebook Ireland Ltd. 

615 This also means that Facebook Ireland Ltd. was responsible for each assignment of 
user and device-related data from the previous operating company Instagram Inc. to 
the user accounts held at Facebook Ireland Ltd. for Facebook.com, including the 
transfer of the Instagram service to Facebook Ireland Ltd. on 25 May 2018 and that it 
required justification under data protection law for all data processing. 

616 For a start, the merger of the Facebook.com and Instagram services under the 
operating company Facebook Ireland Ltd. means that Facebook Ireland Ltd. is now 
solely responsible under data protection law for the processing of personal data of both 
Facebook users and Instagram users. The merger does not mean that combining user 
and device-related data by Facebook.com and Instagram as well as the use of this data 
are no longer subject to the lawfulness requirements of the GDPR. The only difference 
between it and combining data from other companies that are part of the Group is the 
additional transfer and receipt process, which is described in this context by the term 
"recording", because Instagram's operating company already records the relevant user 
and device-related data when Instagram is used. Both the combination of Instagram 
user data and device-related data with the data of users registered under the Facebook 
account ("combining"), as well as their combined use by the operating company of the 
services are subject to a GDPR assessment. 


Munich Commentary on European and German Competition Law, 2nd edition, Section 19 GWB, para. 133 
cf. for instance Langen/Bunte-Nothdurft, Section 19 GWB, para. 355 
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(2) No effective processing on behaif of the controiier 

617 Facebook also has at the very least joint responsibility for the processing of data from 
the Facebook Business Tools described in detail in the operative part of the decision 
(Articles 24 and 26 GDPR). Facebook cannot invoke data processing on behalf of the 
controller within the meaning of Article 4 no. 8 or Article 28 GDPR with regard to data 
processing, in particular for measuring the effect of advertisements and Facebook 
Analytics on the use of the Facebook pixel, SDKs or other interfaces. 

618 Facebook is -at the very least jointly responsible with the third-party providers 

within the meaning of Article 4 no. 7 and Article 26 GDPR^®^ because Facebook 
determines the purposes and means of processing at least jointly with the third-party 
providers. The data collected from Facebook Business Tools only become relevant 
when they are assigned to Facebook user accounts. In addition, the assignment to 
Facebook user accounts leads to further data processing procedures on Facebook 
(storing, combining, organising, using), which the third-party providers themselves are 
unable to keep track of. It therefore cannot be assumed that the third-party providers 
are solely responsible for this essential part of the data processing.®®^ Facebook does 
not dispute its own responsibility for data processing for the most part either. 

619 Contrary to the opinion of the parties,®®® Facebook cannot invoke “data processing on 
behalf of the controller”®^® within the meaning of Article 4 no. 8, 28 GDPR as far as 
measuring the effect of ads and Facebook Analytics via the use of the Facebook pixel, 
SDKs or other interfaces is concerned. 

620 Pursuant to Article 4 no. 8 GDPR, “processor” means a natural or legal person (...), 
which processes personal data on behalf of the controller. This relationship is regulated 
in more detail in Article 28 GDPR. Data processing on behalf of the controller is 
characterised by the fact that a client outsources data processing, which he would 
otherwise have had to carry out himself, to a body bound by instructions, whereby the 


566 |- j 

568 This corresponds to the case law of the European Ceurt of Justice, judgment handed down on 5 June 2018 
("Fan page”),case C-210/16, para. 26, 27., according to which ‘‘the “controller” in Article 2 d) of Directive 
95/64/EC needs te be broadly defined. This ensues from the faet that the Directive seeks to ensure a high level 
of protection of the fundamental freedoms of natural persons, in particular their privacy, with regard te the 
precessing of personal data; this was also the opinion of Advooate-General Bobek of 19 December 2018, case 
C-40/17, para. 65. Since Recital 9 of the GDPR says objectives and principles of Directive 95/46/EC are te 
remain sound, these considerations can also be extended the term "controller” within the meaning of the GDPR. 

569 |- ] 

576 S. Sydow, General Data Protection Regulation 2017, Article 28, para. 11 
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client bears full responsibility under data protection law for the lawful handling of 
personal data in external relations.®^^ 

621 On this basis, transferring the role of the solely responsible data processor in the 
"Facebook Business Tools Terms" to the third-party companies does not constitute 
effective processing on behalf of the controller. 

622 Paragraph 5 of Facebook Business Tools Terms says “To the extent the Customer 
Data contain personal data which you process subject to the (...) GDPR, the parties 
acknowledge and agree that for purposes of providing matching, measurement, and 
analytics services described in Paragraphs 2.a.i and 2.a.ii above, that you are the data 
controller in respect of such personal data, and you have instructed Facebook Ireland 
Limited to process such personal data on your behalf as your data processor pursuant 
to these terms and Facebook’s Data Processing Terms, which are incorporated herein 
by reference”. 

623 Paragraphs 2.a.i, 2.a.ii and 2.a.v. read as follows: 

“2. Use of Customer Data 

H/e will use Customer Data for the following purposes depending on which Facebook Company 
Products you choose to use: 

I. Contact information for matching 

1. You instruct us to process the Contact Information solely to match the Contact Information 
against Facebook's or Instagram's user IDs ("Matched user IDs”), as well as to combine 
those user IDs with corresponding Event Data. We will delete Contact Information following 
the matching process. 

a. Event Data for measurement and analytics services 

1. You instruct us to process Event Data: (a) to prepare reports on your behalf on the impact 
of your advertising campaigns and other online content ("Campaign Reports") and (b) to 
generate analytics and insights about your customers and their use of your apps, websites, 
products and services ("Analytics"). 

2 . (...) 

624 These regulations do not fulfil the requirements regarding processing of data on behalf 
of the controller being governed by a contract pursuant to Article 28 GDPR. Here, the 
processing of data on behalf of the controller is justified by future processors using 
standard clauses that are unilaterally imposed by the alleged controller. 

625 As such, it is doubtful whether standard contractual clauses imposed unilaterally can 
even be regarded as a permissible form of contract under the GDPR. Pursuant to 
Article 28(6) to (8) GDPR, admissible standard contractual clauses are defined either 
by the Commission or by the European Data Protection Board. Recital 81 says the 


571 [...] 

572 Facebook Business Tools terms, item 5.a, B [...] 
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controller and processor may choose to use an individual contract or standard 
contractual clauses. 

626 Regardless of this, the unilateral definition of processing on behalf of the controller and 
the conditions imposed by Facebook are not compatible with the processing of those 
data except on instructions from the controller pursuant to Article 29 GDPR. This means 
the data processor and any person subordinate to the processor who has access to 
personal data may process any such data only on the instructions of the controller. This 
is contradicted by a unilateral specification defined by Facebook in Paragraph 5, 2.a.i 
and 2.a.ii of the Facebook Business Tools Terms which stipulate the limits within which 
the users of Facebook Business Tools are to issue instructions. The terms do not give 
those users the right to issue instructions. Instead, these third-party providers are 
instructed by Facebook. 

627 In addition, the data recorded through the use of the Facebook pixel, SDKs or other 

interfaces on third-party websites are not used by Facebook solely to provide 
aggregated analysis to third-party companies, but are used for Facebook's own 
commercial purposes. In accordance with Paragraph (2) of Facebook Business Tools 
Terms, customer data are also used to personalise features and content on Facebook, 
to improve Facebook Products and to promote the safety and security of these 
products. Data processors can certainly pursue their own interests. 

Nevertheless, the processing must be carried out at the instruction of the controller, 
who alone also determines the purposes of data processing.®^'^ Pursuant to Article 
28(10) GDPR, if a processor infringes this Regulation by determining the purposes and 
means of processing, the processor is considered to be a controller in respect of that 
processing. 

628 Facebook therefore does not play the role of a subordinate processor in the agreed 
relationship with the third-party providers which does not have its own decision-making 
scope with regard to the purposes of data processing. It therefore cannot be compared 
to service providers such as letter shops or call centres.^^^ Facebook does not act like 
an “extended arm” for third-party providers^^® and its activities are not limited to merely 


573 [...] 

57“* Auernhammer, GDPR/Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG), Article 28 GDPR, 
para. 11 

575 The Data Protection Conference cites these examples as services in the form of processing on behalf of the 
controller, see Data Protection Conference; short paper no. 13, status 16 January 2018, p.4, accessible at 
https://datenschutz- hamburq.de/paqes/kurzpapiere-dsqvo/ (last accessed on 10 January 2019). 

576 see Bayreuth Administrative Court, judgment handed down on 8 May 2018, ref. B 1 p. 28.105, para. 50 (juris) 
in relation to Facebook Custom Audiences. 
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providing technical support.^^^ As the provider of Facebook Business Tools, Facebook 
itself determines the purposes for which the collected data is used. Third-party 
companies that integrate the tools cannot instruct Facebook that the data can only be 
used for the preparation of analyses and not also for Facebook commercial purposes. 
Third-party companies do not have any insight into what actually happens to the data 
uploaded or transmitted either. They receive aggregated measurement analyses and 
statistics as the "end product", yet on the basis of the contract they have no influence 
on how Facebook has processed the data in the meantime, for instance to what extent 
the data is assigned to Facebook user accounts and what additional information 
Facebook receives by comparing user behaviour. 

c. No justification under Articie 6 and Articie 9 GDPR 

629 The processing of data collected from Facebook-owned services and Facebook 
Business Tools imposed, described in detail in the operative part of the decision, is not 
justified. 

630 Facebook invokes all data protection legal bases provided for in the GDPR (see (1)) 
for the data processing procedures imposed. Facebook cannot invoke the user consent 
it is asserting pursuant to Article 6(1 a). Article 9(2a) GDPR (see (2)). Data processing 
is not necessary for the performance of the contract pursuant to Article 6(1 b). Article 
9(2b) GDPR either (see (3)). Finally, data processing is not justified by any overriding 
interests of Facebook or third-party providers vis-a-vis the interests and rights of the 
data subject pursuant to Article 6 (1 f) GDPR (see (4)). 

(1) Legal bases invoked 

631 In Facebook’s Data Policy, Facebook declares the following under the heading "What 
is our legal basis for processing data?: 

‘We collect, use and share the data that we have In the ways described above: 

• as necessary to fulfil our Facebook Terms of Service or Instagram Terms of Use; 

• consistent with your consent, which you may revoke at any time through the Facebook 
settings and Instagram settings; 

• as necessary to comply with our legal obligations; 

• to protect your vital interests, or those of others; 

• as necessary in the public interest and 


Bayreuth Administrative Court, ioc. cit. with reference to Dusseidorf Higher Regionai Court, judgment handed 
down on 13 February 2015, ref. no. I 16 U 41/14, para. 36 (coilection service but not data processing on behaif 
of the controlier). 
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• as necessary for our (or others') legitimate interests, including our interests in providing an 
innovative, personalised, safe and profitable service to our users and partners, unless those 
interests are overridden by your interests or fundamental rights and freedoms that require 
protection of personal data”. 

632 Facebook therefore invokes all six available legal bases set forth in Article 6 (1 a) to f) 
GDPR as well as Article 9(2) GDPR to justify data processing. 

633 A hyperlink (“Learn more about these legal bases ...”) takes the reader to another more 
detailed document, in which Facebook provides further explanations for the legal 
bases.^^® In particular, three of the legal bases are mentioned and explained here: the 
processing as necessary for the performance of the contract. (Article 6(1 b) GDPR), 
consent (Article 6(1 a) and Article 9 (2a) GDPR), and the legitimate interests pursued 
by the controller or by a third party, except where such interests are overridden by the 
interests or fundamental rights and freedoms of the data subject (Article 6(1 f) GDPR). 
Furthermore reference is made to the legal basis pursuant to Article 6(1 c to e) GDPR. 
Facebook points out that when it processes users’ data as necessary for a task carried 
out in the public interest, users have the right to object to, and seek restriction of, its 
processing. 

634 On this basis, with respect to all persons who have the legal capacity to enter into an 
enforceable contract, Facebook initially invokes the processing of data "to the extent 
necessary for the performance of the contracts (Facebook Terms of Service and 
Instagram Terms of Service)". The most important data uses for the provision of 
contractual services are the “provision, personalisation, and enhancement of our 
Facebook Products". “To promote safety, integrity and security” “To transfer, transmit, 
store or process your data outside the EEA, including to within the United States and 
other countries" to "To communicate with users, for example, on product-related 
issues" and "To provide a consistent and seamless experiences across the Facebook 
Company Products” are also mentioned. 

635 In addition, Facebook invokes users' consent for, among other things, the processing 
of data with special protection for sharing with selected individuals and personalising 
content, the use of face recognition technology, but also for the use of data provided 
by advertisers and other Facebook partners regarding the user's activity outside 
Facebook Company Products, so that Facebook can personalise the advertisements 
shown to the user on Facebook Company Products and on websites, apps and devices 
that use Facebook advertising services. 


Cf. httDs://www.facebook.com/business/learn/how-business-manaaer-works/auide , [...] 
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636 Facebook initially invokes overriding legitimate interests in relation to people under the 
age of majority who have a limited ability to enter into an enforceable contract and 
whose data on Facebook cannot be processed on the grounds of necessity for 
performance of the contract. In this case, Facebook claims, the provision, 
personalisation and improvement of Facebook Products, the promotion of protection, 
integrity and security, the provision of non-marketing communications were legitimate 
interests, although Facebook specifically targeted people under the age of majority. 

637 Facebook also asserts legitimate interests with respect to all individuals and their data 
for the provision of measurements, analytics and other business services when 
Facebook processes data as the data controller. Facebook highlights the provision of 
accurate and reliable reporting to its advertisers, developers and other partners, to 
ensure accurate pricing and statistics on performance and to demonstrate the value 
that its partners realise using Facebook Company Products and in the interests of 
advertisers, developers and other partners to help them understand their customers 
and improve their businesses, validate Facebook pricing models and evaluate the 
effectiveness of their online content and advertising on and off the Facebook Company 
Products. 

638 It also refers to marketing communications, research and innovation, social purposes, 
sharing information with others and responding to legal requests as legitimate interests. 
The latter help to prevent and address fraud, unauthorised use of the Facebook 
Company Products, breaches of Facebook’s terms and policies, or other harmful or 
illegal activity.^^® 

(2) No effective consent 

639 Users do not give their effective consent within the meaning of Article 6(1 a). Article 
9(2a) GDPR to the processing of personal data pursuant to Facebook's Data Policy in 
respect of processing of data collected from Facebook-owned services and Facebook 
Business Tools. 

640 The consent that needs to be given to Facebook when users sign up with the social 
network is not to be regarded as voluntary consent within the meaning of Article 6(1 a) 
GDPR (see (a)). In relation to the special data categories covered by data processing 
pursuant to Article 9 (1) GDPR, no explicit consent is given within the meaning of Article 
9(2a) GDPR (see (b)). Even the disable (opt-out) options provided for in Facebook's 
privacy settings and the reference made in the Cookies Policy to the browser's or user's 
device settings do not constitute a form of voluntary consent to the processing of data 

579 [...] 
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from Facebook-owned services and Facebook Business Tools, their assignment to 
Facebook user accounts or use of this data, in particular, for personalised ads (see 
(c)). 

(a) Agreeing to the Terms of Service does not constitute consent 

641 Agreeing to the Terms of Service which users are required to do in order to be able to 
use the social network does not constitute voluntary consent pursuant to Article 6(1 a) 
GDPR. 

642 Facebook's explanation in the amended Terms of Service and Data Policy shows that 
- since the GDPR came into force in May 2018 - Facebook still makes use of the social 
network dependent on users “agreeing” to the Terms of Service by clicking on the 
"Register" button. However, Facebook no longer invokes the users' consent which 
needs to be obtained during the registration process as the legal basis under data 
protection law for all data processing procedures.^®® Consent is only mentioned as the 
legal basis for data protection in the Data Policy and in the legal bases - as described 
above - for certain data processing procedures and is obtained in a number of ways. 
In addition, Facebook refers to legal justifications.®®^ Facebook justifies this by claiming 
it has checked the extent to which it relied in the past on consent to data processing 
within the framework of the transposition of the GDPR. Yet Facebook only came to the 
conclusion in certain cases that consent under the GDPR was the most suitable legal 
basis. In other cases, however, Facebook says different legal bases, in particular the 
legal basis enshrined in Article 6(1 b) GDPR, were more suitable for justifying its data 
processing practices.®®^ 

643 Nevertheless, Facebook claims that users voluntarily consent to the service provided 
by Facebook within the meaning of data protection law.®®® As a precautionary measure, 
the Bundeskartellamt therefore points out that it cannot be assumed that individuals 
give their consent voluntarily since users are forced to consent to data processing terms 
when they sign up for a service provided by a company that has a dominant position in 
the market.®®'^ 

644 An essential basis for lawful and appropriate data processing is that data subjects have 
given their consent vo/untar//y (Article 6(1 a) GDPR, Article 7 a) of the Data Protection 
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[...], https://de-de.facebook.com/about/Drivacv/uDdate (last accessed on 10 January 2019), [...]; Facebook, 
“Legal Bases", https://www.facebook.com/about/privacv/leaal bases (last accessed on 10 January 2019), [...] 
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Directive 95/46/EC). This principle of voluntariness is a core element of data protection 
law, which can be derived from Article 8 of the Charter of Fundamental Rights. If 
consent is not given voluntarily, it is ineffective. Otherwise the right to data protection 
would be undermined.Consent must fulfil the conditions of Article 7 GDPR and 
Article 7 a) of the Data Protection Directive 95/46/EC. It is important for the concept of 
"voluntariness" according to Article 2 h) of the current Data Protection Directive 
95/46/EC that the data subjects' consent is freely given to their data being processed 
in the context at hand and in full knowledge of the facts. Article 4 (11) of the GDPR 
says that “consent” of the data subject means any freely given, specific, informed and 
unambiguous indication of the data subject’s wishes by which he or she, by a statement 
or by a clear affirmative action, signifies agreement to the processing of personal data 
relating to him or her. 

645 Furthermore, in the case of consent being freely given (voluntary consent), pursuant to 
Article 7 (4) GDPR, it must be taken into account whether the prohibition of making 
provision of a service conditional on data subjects giving their consent to processing of 
their personal data has been observed. For it says that when assessing whether 
consent is freely given, utmost account shall be taken of whether, inter alia, the 
performance of a contract, including the provision of a service, is conditional on consent 
to the processing of personal data that is not necessary for the performance of that 
contract. Making the provision of service conditional on consent to the processing of 
data, according to Recital 43, would eliminate consent being freely given if there was a 
"clear imbalance" between the data subject and the organisation. Furthermore, 
according to Recitals 42 and 43 of the GDPR, consent should not be regarded as freely 
given if the data subject has no genuine or free choice or is unable to refuse or withdraw 
consent without detriment. 

646 As far as the consent obtained upon registration is concerned, there is no real or free 
choice within the meaning of the above-mentioned Recitals of the GDPR. As such, it 
can remain open whether consent can generally no longer be regarded as being freely 
given if it is required for the provision of service.In any case, Facebook's dominant 
market position creates a "clear imbalance" vis-a-vis users. As outlined above, 
Facebook has a quasi-monopolistic position on the market for social networks vis-a-vis 
users with a user share of more than 90 percent, with the monopolisation trend 
continuing. The direct network effects prevent users from switching to other services. 


Ehmann/Selmayer, General Data Protection Regulation, 2017, Article 7, para. 45 

see Article 29 Data Protection Working Party, Guidelines on consent under Regulation 2016/679 of 28 
November 2017, p. 8ff.; cf., for instance, Harting, General Data Protection Regulation, para. 396f. 
Ehmann/Selmayer, General Data Protection Regulation, 2017, Article 7, para. 53. 
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so it cannot be assumed that users have a free choice within the meaning of data 
protection law. Deciding not to use Facebook would have considerable disadvantages 
for users because they would no longer be able to fulfil their need to participate in the 
social network. 

(b) No explicit consent for special data categories 

647 However, effective consent cannot be deemed to be given in the present case also due 
to the lack of explicit (voluntary) consent to the processing of special data categories 
pursuant to Article 9 (1) a) GDPR within the framework of the "profiling" carried out by 
Facebook, insofar as any such user data are collected from Facebook-owned services 
and from Facebook Business Tools and are subsequently assigned to Facebook user 
accounts. 

648 Facebook obtains explicit consent only with respect to those specific categories of data 
that users have provided voluntarily in their Facebook profile under the headings "Life 
Events" or "Interests”.Users can object to face recognition which was introduced in 
the spring. In this case, Facebook does not match photos and videos with the users' 
profile photo or other photos and videos on which users have been tagged. 

649 Whether or not explicit voluntary consent has been given with regard to this information 
provided on the social network is debatable. 

650 In any event, no explicit and voluntary consent pursuant to Article 9(2a) GDPR has 
been given with regard to the imposed collection of special data categories from 
Facebook-owned services and Facebook Business Tools, the combination of any such 
data by assigning them to Facebook user accounts or to the use of any such data. In 
this regard, Facebook - as outlined above - is wrongly of the opinion that this does not 
involve special data categories within the meaning of Article 9(1) GDPR. 

(c) Privacy settings and browser settings do not constitute consent 

651 Finally, the limited options available in Facebook's ad settings (see i.) and the reference 
made to browser and device settings used to block cookies or ad IDs on mobile devices 
(see ii.) do not constitute voluntary consent to the recording of data from Facebook- 


cf. Facebook Data Policy, “What is our Legal Basis for processing data?", https://de- 
de.facebook.com/about/privacv/update , [...]; Facebook, “Legal Bases", 

https://www.facebook.com/about/privacv/leqal bases , [...] If the users click the link "data with special 
protections", they are taken to the heading "What kinds of information do we collect?" in the Data Policy. Flere 
it says in relation to “Data with special protections”: “You can choose to provide information in your Facebook 
profile fields or “life events” about your religious views, political views, your health or who you are "interested 
in". This and other information (such as racial or ethnic origin, philosophical beliefs or trade union membership) 
is subject to special protections under EU law”, [...] 
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owned services and Facebook Business Tools or to the combination of this data with 
Facebook user accounts. 

i. Settings for personalised advertising 

652 The options available in Facebook ad settings do not mean voluntary consent justifies 
the collection of data from Facebook Business Tools or the combination of this data 
with Facebook user accounts. 

Ad settings 

Ads based on data from partners 

i. sr.OA you better ads. we use data that advertisers arrd other partrrers provide us about your activity off Not allowed 

rddcbojk Company Products 


Ads based on your activity on Facebook Company Products that you see elsewhere 

When we show you ads olT FacebooK Company Products such as on websites, apps and Oeinces that use our allowed 

advertising services, we use data about your activity on Facebook Company Products to mate them more 
relevant 

Ads that include your social actions 

.'.'e mav include your social actions on ads, such as liking the Page thafs -inning the ad Who carr see this No One 

info'? 

3 the option to also see ads "on the basis of partner 

data". 

654 If users decide not to have ads displayed on the basis of partner data, ads that are no 
longer based on the partner data will continue to be displayed. Opting out of various 
settings does not affect the collection of data from Facebook Business Tools or prevent 
any such data being combined with Facebook user accounts. In this respect, users 
have no control mechanisms whatsoever.^®® They have no way of controlling what data 
is recorded or combined with data from other Facebook-owned services. 

655 Even though the user's consent to the display of advertisements based on partner data 
is now structured in the form of an "opt-in", this does not constitute voluntary consent 
to the processing of data by combining it with Facebook user accounts or to using this 
data for all other purposes of the social network. The opt-out possibility only prevents 
personalised ads from being displayed, but it does not prevent all other data processing 
procedures, namely data recording, data matching, combination and linking, storage, 
organisation, etc., all of which take place anyway. This also ensues from the legal 
bases described above which Facebook invokes. It says that consent “...for using data 
that advertisers and other partners provide us with about your activity off Facebook 
Company Products, so we can personaiise ads that we show you on Facebook 
Company Products, and on websites, apps and devices that use our advertising 
services..." In Facebook’s own words, consent therefore does not cover the term 
"recording", which describes all data processing procedures that do not consist of use 

5®® Screenshot at https://www.facebook.coin/ads/preferences/7entrv product=ad settings screen (last accessed 
on 8 January 2019), [...] 
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653 Facebook users can 
control their "ad 
preferences” in their “Ad 
settings”.®®® However, 
these control options only 
apply to the dispiayot ads. 
Among other things, users 
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for advertising purposes. Facebook itself only invokes (all) legal justifications in this 
respect. Users can only influence one purpose in relation to use of their data. 
Conversely, consent to use of data for advertising purposes cannot be construed as 
consent to the collection and combination of data. This is because users giving their 
consent have the impression that the data is already available on Facebook and will be 
used for other purposes. 

ii. Blocking of cookies and advertising IDs 

656 The ability to block cookies in the browser or disable ad tracking on mobile devices 
does not constitute voluntary consent to all data processing procedures regarding the 
recording, combination and use of data collected from Facebook-owned services and 
Facebook Business Tools and assigned to Facebook user accounts either. Incidentally, 
it is not clear to what extent Facebook is actually invoking consent in this respect. In 
connection with consent, the above comments on the legal bases also mention “For 
collecting information that you allow us to receive through the device-based settings 
you enable ...”. The Cookies Policy does not make any reference to the legal basis. 
Regardless of this, sufficient consent is not evident here either. 

657 Facebook sets various cookies on the users' computer the first time they visit the social 
network before they register, when they use a web browser. Cookies regularly contain 
information that allows users to be tracked online. The browser also connects to 
Facebook any time users visit websites with their browser, and transmits user and 
device-related information as well as information about the website. The first time users 
visit a Facebook page, a so-called cookie banner is displayed, which refers to the 
cookie setting for the processing purposes Facebook specified in its Data Policy and 
which users agree to by further scrolling or navigating on the page. The cookie banner 
also contains a reference to the Cookies Policy to which users are directed via a 
hyperlink. 

658 The last paragraph of the Cookies Policy says under the heading “Browser cookie 
controls” that the browser or device may offer settings that allow users to choose 
whether to set browser cookies or to delete them. The Cookies Policy refers to the help 
functions of the browser or the device. Facebook also points out in this paragraph of 
the Cookies Policy that certain parts of the Facebook Products may not work properly 
if users have disabled browser cookie use. 
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659 However, in the vast majority of cases, the Facebook.com social network is not 
accessed via a web browser, but with the mobile app on a mobile device. Mobile 
cookies have not been used for some time now and users are identified by means of 
other "identifiers". In its Data Policy, Facebook indicates that it uses these kind of 
identifiers in order to obtain information about users.This means users and their 
devices can be tracked, inter alia, via the advertising ID assigned to the mobile device 
when using the apps installed on the device and 

^ Datenschutz Werbung 

when interacting online with the device. The 
advertising ID is, as shown, a unique identifier 
alongside other device IDs. However, unlike the 
fixed MAC address or the I EM I, users can choose 
settings regarding the use of the advertising IDs 
and "reset" the advertising ID at the level of the 
operating system of the mobile device. This 
means the advertising ID is replaced by a new, 
randomly selected, unique number. 

660 Neither the ability to disable cookies in browser settings nor the settings on the mobile 
device can provide the basis for voluntary consent to the comprehensive collection of 
data from Facebook-owned services and Facebook Business Tools, the combination 
of this data to Facebook user accounts, or the use of this data. 

661 The currently applicable Directive 2002/58/EC (“e-Privacy Directive”) indicates in 
Article 5 (3) that the storage of information or access to information is only allowed on 
condition that the subscriber or user concerned is provided with clear and 
comprehensive information pursuant to Directive 95/46/EC, inter alia about the 
purposes of the processing, and is offered the right to refuse such processing by the 
data controller.®®^ It is therefore questionable whether it is sufficient for consent to the 
setting of cookies that users are made aware of the possibility of choosing browser 
settings that define standards for the permission of cookies. In this respect. Recital 32 
sentence 2 GDPR approves the selection of technical settings as a means of consent. 


ALLE WERBEANBIETER 
Kein Ad-Tracking 

Ad-ID zurucksetzen... 


O 


Du kannst dich entscheiden, keine auf deinen 
Interessen basierenden Anzeigen zu erhalten. 
Mdglicherweise wird dir genauso viel Werbung 
wie bisher angezeigt, die jedoch weniger relevant 
sein wird. 


Data Policy, “What kinds of information do we collect?" (...) Identifiers: Unique identifiers, device IDs and other 
identifiers, such as from games, apps or accounts that you use, and Family Device IDs (or other identifiers 
unique to Facebook Company Products associated with the same device or account)”, [...] 

cf. also https://www.checked4vou.de/apD tracking deaktivieren : 

httDs://mobilsicher.de/hinterarund/smartphone-nutzer-sollten-ietzt-ihre-werbe-id-aendern (in German, last 
accessed on 10 January 2019). 

Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the 
processing of personal data and the protection of privacy in the electronic communications sector (Directive on 
privacy and electronic communications), Official Journal no. L 201 of 31 July 2002 p. 37 - 47. 
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However, voluntary (freely given) consent according to the GDPR requires an "Opt-in" 
configuration. Yet no such “Opt-in” configuration is available here. 

662 For cookies are set the first time users visit a Facebook page unless they leave it again 
immediately. Users must then delete the cookies after visiting a Facebook page for the 
first time, using the option to disable the cookies via their device or browser settings. 
At best, this represents an opt-out function, although Facebook does not offer an actual 
opt-out function, but instead refers to other services. 

663 Even if consent could be considered to have been given to the setting of cookies by 
not selecting the blocking options, this consent cannot extend to comprehensive 
recording of data from Facebook-owned services and Facebook Business Tools via 
the respective interfaces that are assigned to Facebook user accounts using the cookie 
data which facilitate comprehensive profiling. In addition, there are other ways in which 
data can be combined with Facebook user accounts even when cookies have been 
disabled. 

664 Facebook collects a large amount of device-related data both when Facebook.com and 
Facebook-owned services and Facebook Business Tools are used. In their entirety, 
these represent an almost unique fingerprint of individual users, meaning there is no 
need to assign data to Facebook user accounts via cookies in the first place. The 
possibilities users have of preventing fingerprinting are limited and difficult to access 
due to the technical complexity involved. By installing browser “add-ons“, such as 
"NoScript", users can block JavaScript or Flash, meaning that less information can be 
collected. This can mean that websites are no longer displayed correctly. In addition, 
they represent a user setting that can enable personalisation, especially if only a small 
group of people block fingerprinting. 

665 This explains why setting options on mobile devices with regard to the advertising ID 
certainly do not provide a basis for voluntary consent. The device setting also leads to 
the advertising ID being recorded by Facebook via the mobile interface. This results, 
for instance from Facebook's code instruction for the integration of the "App Events 
API". This means the advertising ID is transmitted every time users access the app and 
is merely supplemented with information on the users' settings for advertising 
tracking.^®^ The setting is therefore only relevant for the display of interest-based 
advertising. Resetting the advertising ID does not prevent further assignment of data 
to Facebook user accounts either. When users open the Facebook app, the advertising 
ID for their device is again sent to Facebook and is directly assigned to their Facebook 


Cf. httDs://www.facebook.com/business/learn/how-business-manaaer-works/auide , [...] 
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user account. Users would then need to manually reset the advertising ID each time in 
order to make it more difficult to collect this information. 

(3) Data processing is not necessary for performance of the contract, Articie 6 (1 
b) GDPR 

666 The processing of data collected from Facebook-owned services and Facebook 
Business Tools imposed is not justified pursuant to Article 6(1 b) GDPR contrary to the 
opinion Facebook^®'^ expressed in the proceedings. 

667 For a start, the need to process data collected from other Facebook-owned services or 
Facebook Business Tools for the performance of the contract concluded with private 
users cannot be justified on the basis of the contents of the Terms of Service that are 
imposed unilaterally (see (a)). It cannot be argued that there is a contractual link 
between all Facebook Products. (See (b)). Data processing from all sources is not 
necessary for the claimed contractual purposes either (see(c)). 

(a) Article 6 (1b) GDPR does not apply when the contractual contents are imposed 
unilaterally by the dominant company 

668 The justification set forth in Article 6(1 b) GDPR is not applicable on the basis of the 
statement issued by the Article 29 Data Protection Working Party when a dominant 
company dictates the contractual contents. 

669 In describing its legal basis for performance of the contract, Facebook refers to the 
description of the contents of the contract defined in the Terms of Service under the 
heading "Our services". Facebook uses a headline followed by a few examples to 
describe what users are offered. The following headlines are listed: We “Provide a 
personalized experience for you”, “Connect you with people and organizations you care 
about”, “Empower you to express yourself and communicate about what matters to 
you”, “Help you discover content, products, and services that may interest you”, 
“Combat harmful conduct and protect and support our community”, “Use and develop 
advanced technologies to provide safe and functional services for everyone” 
“Research ways to make our services better”, “Provide consistent and seamless 
experiences across the Facebook Company Products”, “Enable global access to our 
services”. 
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670 In the present proceedings, Facebook refers in connection with Article 6(1 b) GDPR in 
particular to the provision of personalised services and the display of personalised 
advertising, for which it claims all data processing from all sources is necessary.®^® 

671 Neither Facebook's claim in the present proceedings nor the one-sided definition of the 
services in its Terms of Service can justify a contractual requirement for data 
processing conditions that facilitate comprehensive processing even of data collected 
from Facebook-owned services and Facebook Business Tools for profiling purposes, 
among other things. With regard to the required narrow interpretation of the justification 
set forth in Article 6(1 b) GDPR, not all conceivable data processing procedures 
associated with the service can be covered by the economic interest of a self-defined 
data-driven business model that uses personalised services and personalised 
advertising. The Article 29 Data Protection Working Party has always represented the 
view in relation to Article 7 of Directive 75/46/EC b) which is identical to Article 6 (1b) 
GDPR that the term "necessary" for the performance of the contract needs to be 
narrowly construed.^®® Contrary to Facebook's view, case law also requires a narrow 
interpretation of these grounds for justification.®®^ 

672 This means that data processing is only necessary for the performance of the contract 
if, on reasonable grounds, the company's reliance on the specific means in question 
can be affirmed and it is unreasonable or inacceptable to refrain from using the data.®®® 
However, the provision does not apply to situations where processing is not really 
necessary for the performance of the contract, but where the contents of the contract 
and data processing are unilaterally imposed on the data subject by the controller.®®® 

673 Facebook's claim that the - strongly fact-driven - examination required by the guidelines 
issued by the Article 29 Data Protection Working Party must first determine the exact 
purposes of the contract, i.e. its content and fundamental objective, and whether these 
purposes are crucial for assessing the balance of interests and whether the data 
processing is necessary for contractual performance, is therefore irrelevant.®®® For the 


595 |- ] 

59® “Opinion 06/2014 on the concept of "legitimate interest of the controller pursuant to Article 7 of Directive 
95/46/EC" of 9 April 2014, 

httpsV/www.bfdi.bund.de/SharedDocs/Publikationen/DokumenteArt29GruDPe EDSA/Stellunanahmen/WP217 

Opinion62014Leaitimatelnterest.html , [...] 

597 cf. for German law Hamburg Administrative Court, judgment handed down on 24 April 2017, p. 32 with reference 
to Gola/Schomerus, Federal Data Protection Act, Section 28, para. 15 and 25. 

598 Hamburg Administrative Court, judgment of 24 April 2017, p. 32. 

599 Opinion 06/2014 on the concept of legitimate interest of the controller pursuant to Article 7 of Directive 95/46/EC'' 

of 9 April 2014, 

https://www.bfdi.bund.de/SharedDocs/Publikationen/DokumenteArt29Gruppe EDSA/Stellunqnahmen/WP217 
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"fact-driven" assessment which Facebook refers to - for which, incidentally, Facebook 
bears the burden of proof - would be limited solely to the purposes pursued by 
Facebook if the content of the contract was determined unilaterally. Facebook's 
statement in this particular case clearly shows this too. 

674 There is no evidence to suggest that under the GDPR another, in particular broader 
interpretation of the justification than under the Directive 46/95/EG is required.The 
substantive legal situation, which was already fully harmonised with the justifications in 
Article 7 of Directive 95/46/EC in all Member States, has not changed as a result of the 
GDPR. Also the Article 29 Data Protection Working Party reaffirmed the previous 
narrow interpretation of the justification in the context of the "Guidelines on automated 
decisions in individual cases including profiling for the purposes of Regulation 
2016/679” for Article 6 (1) (b) GDPR.®®^ 

675 This also holds true most particularly when taking the prohibition of making the 
provision of a service conditional on consent to the processing of personal data into 
account that is now governed by Article 7 (4) GDPR. Until now, it had to be denied that 
voluntary consent exists if a dominant company has made the provision of its service 
dependent on consent to all data processing procedures - as has been the case with 
Facebook for years®®®. The explicit provision governing the prohibition of making the 
provision of a service conditional on consent to the processing of personal data set 
forth in Article 7 (4) 4 GDPR, if there is a clear imbalance between the data subject and 
the organisation®®'^, therefore does not expand the legal justifications, the wording of 
which has remained unchanged, in order to compensate for the limited possibility of 
obtaining consent. 

676 Rather, the unilateral imposition of contractual contents and data processing must also 
be taken into account within the framework of assessing whether they are necessary 
and whether a company has a dominant position in the market, as can be clearly seen 
from the above-mentioned arguments put forward by the Article 29 Data Protection 
Working Party. It cannot be assumed that all of Facebook's data processing 
procedures, for which consent upon registration has hitherto been invoked as the 
primary legal basis, are now necessary owing to the extensive and unlimited definition 


In its guidelines on consent under the GDPR, the Article 29 Data Protection Working Party refers explicitly to 
WP 06/2014, see Art. 29 Data Protection Working Party, "Guidelines In relation to consent under Regulation 
2016/679, 

https://iapp.ora/media/Ddf/resource center/20180416 Article29WPGuidelinesonConsent publishpdf.pdf. [...] 

Guidelines on automated decisions in individual cases including profiling for the purposes of Regulation 
2016/679 of 3 October 2017, most recently revised and adopted on 6 February 2018; 
https://www.facebook.com/leaal/terms?ref=pf , [...] 
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of services in the Terms of Use for the performance of the contract. Facebook continues 
to invoke the agreement to the Terms of Service which users are still required to give 
when they sign up with the service that forms the contract between Facebook and 
users, and which unilaterally make all of Facebook's possible interests part of the 
contents of the contract with users who must then agree to comprehensive data 
processing. The former mandatory consent to data processing has simply been 
replaced by the mandatory agreement to the Terms of Service which freely determine 
the contractual necessity. 

677 When determining the contractual necessity, it is essential that the company’s 
dominant position in the market also be taken into account within the framework of the 
assessment. For users cannot exert any influence on the contents of the contract that 
have been unilaterally specified in the Terms of Service, nor can they evade the Terms 
of Service resulting in such extensive data processing by switching providers, since 
Facebook is the dominant company in this market. In this respect, the dominant 
company has a special responsibility when defining the product characteristics in its 
Terms of Service and its strategic product decisions, which completely contradicts the 
need for data processing as defined by a performance promise unilaterally given in the 
Terms of Service. This is why the justification grounds according to Article 6(1 b) GDPR 
cannot be invoked. In any such case, it is instead the voluntary consent pursuant to 
Article 6(1 a) GDPR that provides the relevant and necessary legal basis for data 
processing. 

(b) No contractual link between all Facebook Products 

678 Even if Article 6(1 b) GDPR applied to unilaterally determined contractual contents, the 
Facebook-owned services offered separately by Facebook.com and Facebook 
Business Tools cannot be made the subject matter of the contract by making the 
provision of service conditional on the processing of personal data for Facebook users, 
for instance by referring in the Terms of Service to a "more personalised and consistent 
experience in all Facebook Products used”. 

679 On the contrary, taking into account the assessment of fundamental rights as well as 
the fact that a market-dominating company is involved means the subject matter of the 
contract needs to be limited and the necessity of data processing for performance of 
the contract must be subject to narrow interpretation. In this respect, data processing 
can, in principle, only be considered necessary for a narrowly-defined main purpose of 
the contract, beyond which not all data processing that is useful is actually 
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necessary.®^® This was also clearly expressed by the Article 29 Data Protection 
Working Party. Accordingly, the fact that some data processing is covered by a contract 
does not automatically mean that the processing is necessary for the performance of 
the contract. The Article 29 Data Protection Working Party gives the necessity of 
providing a delivery address when ordering goods online for the delivery of the goods 
as an example. Article 7 b) of Directive 95/46/EC does not provide any basis in this 
case for creating a user profile regarding their product preferences. 

680 The use of Facebook.com does not include the use of the other Facebook-owned 
services, for which independent registration processes are required and separate user 
contracts are concluded. Facebook itself contends that users are not forced to use the 
company's other services in addition to Facebook.®°^ It is not clear either why, however, 
these products should nonetheless be part of the user experience on Facebook.com 
as the main purpose of providing the service Facebook.com and why users do not have 
the possibility of deciding for themselves on the cross-product processing of their data 
by way of voluntary consent. 

681 This applies not only to the services operated by other companies belonging to the 
Facebook Group, such as WhatsApp, Oculus and Masquerade. Contrary to Facebook's 
claim®°® it applies equally to the combination of data collected from Instagram with 
Facebook data. Neither the fact that Instagram is operated by the same company 
belonging to the Group as Facebook.com, nor the identical wording of Terms of Use 
and data policies are sufficient to substantiate a common contractual purpose. 

682 Instagram is also a predominantly mobile service that is still offered separately from 
Facebook.com, requiring independent registration and login, which also establishes 
independent contractual relationships. Facebook also highlights the fact that users 
must conclude two separate contracts in order to use Instagram and Facebook.com. 
Contrary to Facebook's view, it therefore cannot be assumed that providing a 
consistent experience of use across both services is the subject matter of the two 
contracts.®°® Instagram has not been integrated into Facebook.com in the sense that 
Instagram is a photo service that is part of Facebook.com's offering, which would be 
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problematic under antitrust aspects. This also applies to WhatsApp and other 
Facebook-owned services. 

683 The fact that users are informed on Facebook.com, for example, if friends are also 
active on Instagram and that they can access the Facebook.com service via a link, 
does not lead to the integration of services that pursue a common contractual purpose 
under data protection law with all the data processing requirements this entails. Rather, 
this is primarily a marketing communication for Facebook-owned products aimed at 
encouraging Facebook users to use a corresponding photo service provided by 
Facebook. 

684 That the Facebook.com Terms of Service stipulate they govern the "use of Facebook 
and the products, features, apps, services, technologies and software that we offer (the 
Facebook Products or Products)", "except where we expressly state that separate 
Terms (and not these) apply" does not create a common contractual purpose, but only 
identical terms of use with separate contracts being concluded. 

685 Facebook Business Tools are also integrated and used on a separate contractual 
basis with the "Facebook partners". Facebook Terms of Service do not refer to the 
Facebook Business Tools Terms either. The subject matter of the contract for use of a 
social network by consumers cannot, regardless of this, extend to Facebook Products 
offered to third parties. 

686 This also applies to social plugins such as the "Like" button or the "Share" button as 
well as to the Facebook Login. These are directly related to the features of a social 
network, as they allow Facebook users to communicate directly with their network on 
Facebook.com from third-party websites or apps, and to log into third-party websites or 
apps using Facebook registration data. However, the provision of these functionalities 
depends on whether the third-parties enter into a contract with Facebook as Facebook 
partners meaning they cannot be a mandatory part of the social network functionalities. 

687 The measurement and analytics services implemented via the Facebook pixel and SDK 
are also available to third parties. Facebook summarises a number of different services 
that fulfil different functions under the term "measurement and analytics services" (see 
above para. 66ff). Essentially, a distinction can be made between the measurement 
and analysis of the success of ads placed on Facebook and the measurement and 
analysis of user behaviour on websites or apps, regardless of whether they are 
currently Facebook advertisers. Both variants are offered on the basis of contracts with 
third parties. Users can only see a correlation with the functionalities of a social network 
indirectly, if at all, with regard to ads on Facebook. The "pure" measurement and 
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analytics services have no visible correlation for users. In this respect, Facebook is 
obviously relying on Article 6(1 f) GDPR in the legal bases it invokes. 

(c) Data processing is not necessary for contractuai purposes 

688 Finally, data processing cannot be deemed necessary for the purposes indicated. 

689 The subject matter of the contract with the provision of a "personalised experience" and 
of "consistent and seamless experiences across the Facebook Company Products" or 
combating “harmful conduct" and protection and support community, research ways to 
make services better, etc. are phrased so vaguely that it is virtually impossible to 
assess whether or not they are necessary. It is not clear either which data is specifically 
necessary for which subject matter of the contract. Facebook has not submitted any 
detailed explanation. The above-mentioned required narrow interpretation of Article 
6(1 b) GDPR does not permit the assertion of such vaguely phrased contractual 
purposes. 

i. Personalised user experience 

690 The fact that data processing from other Facebook-owned services and from Facebook 
Business Tools might be useful or efficient for personalising the service cannot be 
justified as being necessary for contract purposes either. 

691 In the present proceedings, Facebook claims primarily that the data provides the basis 
for a personalised Facebook user experience, consisting of the fact that users can find 
the individuals, groups and content that interest them personally. It is only data which 
users share about themselves and the information which Facebook collects about 
individual user behaviour that enable Facebook to offer users this personalised user 
experience in the first place.According to Facebook, the very essence of the 
Facebook service is therefore that it is tailored to the individual user.®^^ Data processing 
was therefore a key element of the service and not merely a side effect. The offer of 
targeted advertising was also part of this personalised user experience. Since 
advertising is necessary to finance the provision of the network free of charge, 
Facebook claims it is an added value for users, instead of seeing 'random' advertising, 
to see personalised advertising that interests them more. It says the comprehensive 
collection of personal data is necessary to provide the product. Facebook says the 
broader the database, the more effective a service it can provide.®^^ It claims that 
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limiting data processing is always unreasonable because it interferes with Facebook's 
product design. 

692 This view means the company would be entitled to unlimited data processing solely on 
the grounds of its business model and product properties as well as the company’s 
idea of product quality. Any kind of data processing would then have to be deemed 
“necessary for contractual performance” as all data would in some way lead to 
knowledge being obtained about the individual user, users’ personal profiles being 
specified and, by means of technical algorithms, the social user experience on 
Facebook being improved and users being shown targeted ads. This means everything 
that is technically possible within the framework of progressive digital technology could 
be deemed necessary for performance of the contract.®^^ 

693 The possibility of comprehensive data processing from all sources as the only effective 
performance of a contract would not represent a "balancing" of the interests concerned, 
which Facebook also considers to be necessary within the framework of Article 6(1 b) 
GDPR®^'*, but would merely serve Facebook’s own commercial interests. For the mere 
usefulness for the business model with personalised services and personalised 
advertising means the justification according to Article 6(1 b) GDPR and thus ultimately 
the data protection lawfulness would be completely open to interpretation by the 
company. The company would not need to assert any overriding interest in data 
processing with regard to the business purpose pursued vis-a-vis the fundamental 
rights of the data subjects pursuant to Article 6(1 f) GDPR or even to obtain their 
consent. This is tantamount to relinquishing the fundamental right to data protection or 
to informational self-determination. 

694 The limited possibilities users currently have of influencing the level of personalisation 
of the service cannot, contrary to Facebook's view, be used as "protective measures” 
to ensure data processing is balanced and proportionate. Facebook points out in this 
regard that users can influence the product properties via the ad settings, by giving 
feedback on their content and by using the News Feed settings.However, these 
setting options have no impact whatsoever on the data processing terms at issue here 
and certainly do not lead to a relevant limitation of data processing. In some cases, the 
above-mentioned options actually generate additional interest-based user data. The 
very fact that users can choose not to be shown personalised ads based on partner 


Weichert, DatenschutzverstofB als Geschaftsmodell -der Fall Facebook (available In German only), DuD 2012, 
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data instead shows that data processing for the personalisation of ads is not necessary 
for performance of the contract. 

695 Furthermore, the Bundeskartellamt considers it to be incorrect that Facebook would be 
unable to provide a personalised service with Facebook.com and the personalisation 
based on it unless it processed data collected from Facebook-owned services and 
Facebook Business Tools.It is true that the service and the ads shown might be less 
accurate and effective by Facebook’s own standards if data was not processed from 
other Facebook-owned services and from Facebook Business Tools.However, 
contrary to Facebook's view, it does not mean Facebook would be unable to provide 
the service outlined in the user contract if it refrained from using these sources.®^® Given 
the amount of data associated with Facebook user accounts that Facebook already 
processes when the social network is used, it is not clear what significant value the 
data from these sources have that can justify a personalised use of the social network 
in the first place. 

696 These proceedings specifically do not involve the data processing procedures that 
occur when the social network is used under the Facebook user account. It remains to 
be seen how the conflict between efficient "big data" business models and users’ right 
to informational self-determination can be resolved in this respect. It is however also 
extremely doubtful in the Bundeskartellamt's opinion whether data processing on the 
basis of Article 6(1 b) GDPR which is practically unlimited can be justified by claiming it 
is necessary for performance of the contract using Terms of Service that are imposed 
unilaterally. Here, however, in individual cases Facebook could possibly be considered 
to have an overriding interest pursuant to Article 6(1 f) GDPR in processing data 
generated by the users themselves through active use or generated automatically in 
the social network regarding the potential efficiencies of data processing for the service 
and its users as well as independent use of social media by users. Here, users have 
considerable possibilities of controlling the data generated about them in terms of 
extent and nature of their activities on Facebook. 

697 Facebook’s Data Policy says that all content, communications, and other information 
users provide when using Facebook.com is collected and used. This includes 
information users provide when they sign up for an account, content and messages 
written to and exchanged with others, the metadata of content such as location or what 
users see when they look through the Facebook camera. Facebook records all 
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networks and connections on the social network, the address book data uploaded, the 
contacts, people. Pages, accounts, hashtags and groups that users are connected to. 
Facebook collects information about how users use the social network, such as the 
types of content they view or engage with, how long they spend looking at a video or 
advertisement, the frequency and duration of their activities as well as financial 
transactions carried out via Facebook.com. 

698 Regardless of whether this amount of user and device-related data that is processed 
when using the social network Facebook.com is actually necessary for contractual 
performance, it is utterly incomprehensible why sufficient personalisation of the use of 
Facebook.com can only be safeguarded if data collected from other Facebook-owned 
services and Facebook Business Tools are processed. It is not clear from the Terms of 
Service or the policies, the Data Policy in particular, or indeed from the arguments put 
forward by Facebook, what information and data collected from the individual 
Facebook-owned services and Facebook Business Tools is necessary for performance 
of the contract, and why it is even necessary in the first place. 

699 This initially applies to the Facebook-owned services Oculus and Masquerade that 
are offered separately, that have a comparatively low penetration rate and whose 
contribution to personalisation for all Facebook users is thought to be relatively small. 
The WhatsApp user information that is not currently used to "improve the product 
experience" or to "display more interesting advertising" on Facebook according to the 
WhatsApp FAQs®^® is not necessary for the purposes claimed either. However, this 
also applies to Instagram data, large volumes of which are collected. Given that 
Facebook.com has a much larger user base and higher usage intensity, it is not clear 
what Instagram’s contribution to Facebook.com is. The example given by Facebook 
that information indicating users are following an event on Instagram is also used to 
personalise the News Feed on Facebook.com, meaning it is essential for contractual 
performance®^®, is not convincing either. The mere usefulness of information about user 
behaviour obtained from other services is precisely not sufficient to justify that this 
information is necessary to provide Facebook.com.®^^ 

700 The same applies to Facebook Business Tools. In these proceedings, Facebook 
argues that data collected from these sources are necessary for personalising the 
service as a whole.®^^ In addition, Facebook refers to other legal bases for data 
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processing via Facebook Business Tools, in particular involving consent to the 
processing of data for personalised advertising, processing of data on behalf of the 
data controller and the legitimate interests in providing measurements, analytics and 
other corporate services when Facebook is the data controller processing data.®^^ 

701 However, the processing of data collected from Facebook Business Tools imposed is 
not necessary to create a "personalised user experience" or for the associated range 
of functionalities, insofar as they are connected with use of the social network. 

702 This applies first and foremost to the social plugins, which enable Facebook users to 
communicate directly with their network on Facebook from third-party websites or apps. 
The social plugins make it possible to track user activities on the website and the URL 
of the previously visited website. When the website or app is accessed, the Facebook 
server automatically receives at least the IP address, the browser type, the URL of the 
website and the time at which the website was visited, as well as the user ID or ad ID 
via a previously set cookie that transmits the user ID or ad ID without the button having 
to be pressed by the user. 

703 Providing a "Like" or "Share" button or another social plugin for Facebook users and 
third parties does not require any flow of data to Facebook about the use of the website 
if the user does not interact with the button.Only when the user clicks on the button 
does a certain data record become necessary, which enables data to be assigned to 
the Facebook user account under which it is to be distributed on Facebook.com. The 
correct display of the website taking the browser configuration into account, for which 
some standard data are useful, does not require a direct data flow to Facebook either, 
but to the website operator. It is obvious that it is not necessary for the functionality to 
be assigned to and combined with the data already stored on Facebook under the 
Facebook user account. 

704 Data processing via the Facebook Login and Account K/fwhen accessing the website 
or app without the user pressing the button is not necessary to offer the functionality in 
connection with use of the social network is not necessary for social plugins for the 
same reasons. Similar to social plugins, by integrating the Facebook login, Facebook 
receives information from third-party websites and apps about the websites/apps 
Facebook users have signed up with and how they use the respective website/app. As 
such, it is just as unnecessary for the user to activate the Facebook Login to initiate a 

62^^ Cf. also the Court of First Instance Belgium, judgment handed down on 16 February 2018, p. 65 of the English 
translation, [...]: “The court concurs with the point of view of the Privacy Commission, that the systematic 
coliection of the personat data of users and non-users via social plugins on the websites of third parties is not 
essential (let alone „strictly essential" in the sense of Art. 129 ECA), or at least not proportional to the 
achievement of the safeguarding objectives (...)” 
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data flow as it is for the social plugins. For a start, the volume of data that Facebook 
currently receives is the same as for social plugins. The company also receives the 
login information the user enters directly and manually - without having to use the 
Facebook Login - with the provider who has embedded the Facebook Login. 

705 There is no need for data to flow to Facebook about the use of the website or even the 
user's login data without the user interacting with the button in order to provide a 
convenient log-in option for Facebook users or the use of social plugins. Only when 
users click the button does a limited data record have to be sent to Facebook for the 
login data to be transferred to the website. 

706 The comprehensive data processing which combines data from the measurement and 
analytics services implemented via the Facebook pixel and SDKs which is carried out 
via comprehensive web tracking across millions of websites and apps is not necessary 
for performance of the contract either. What these services have in common is that in 
technical terms the Facebook pixel, SDKs or another interface need to be embedded 
in a third-party website or app. These facilitate a massive amount of data processing 
for a wide variety of data, which are then assigned to Facebook user accounts - also 
by means of active fingerprinting (see in detail above para. 139ff.) Any such massive 
web tracking, which affects users’ internet usage, cannot, in view of the need for narrow 
interpretation of the concept of necessity, be justified pursuant to Article 6 1 b) GDPR. 

707 Furthermore, as regards measuring the success of advertising, the argument that the 

data processing imposed is necessary in order to be able to display personalised 
advertisements effectively cannot be used to explain why data processing is 

necessary for the financing of Facebook advertising either. The fact that Facebook 
makes use of data collected from Facebook partners for personalised advertising 
conditional on users' consent mitigates against this. 

ii. Other contractual purposes 

708 It cannot be deemed necessary for contractual performance for other purposes 
designated as the subject matter of the contract either. 

709 The processing of data collected from Facebook-owned services and Facebook 
Business Tools imposed, as set forth in the Data Policy, is not necessary to provide 
"consistent and seamless experiences across all Facebook Company Products" or for 
any other purposes that are the subject matter of the contract as part of contractual 
performance. 
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710 For a start, the reservations expressed about the poorly specified terms indicate that 
this purpose of the contract should not be considered. For instance, it does not say 
specifically what “consistent and seamless experiences across all Facebook Company 
Products” actually means or what data is necessary to provide this experience. 
Integration with Facebook.com in the sense that Instagram or WhatsApp and other 
products are perceived as part of Facebook.com's offering would also be questionable 
under antitrust law as it makes the provision of the service conditional on the processing 
of users’ personal data of those other services. In addition to de facto integration, there 
is a risk that market power could be transferred to Instagram and other services by 
combining data into a de facto uniform user account with associated and shared user 
data and by transferring friends and subscriber lists to Instagram. This would further 
secure Facebook's existing market power despite competition from Snapchat or other 
messenger services on the market’s periphery. Within the framework of the concept of 
"necessity" and the consideration that needs to be given in this context, Facebook’s 
dominant position in the market must therefore also be taken into account. 

711 It is not clear what importance Facebook Business Tools have for this contractual 
purpose. As far as the functionalities of the social plugins and the Facebook Login are 
concerned, it cannot be assumed that a data flow is necessary for this purpose if and 
when the functionalities are not used. 

712 Nor is it clear with regard to the alleged user and network security, including the security 
aspects presented by Facebook such as the prevention of child abuse or terrorist 
activities, why, irrespective of any concrete suspicion, a partially unlimited collection 
and use of data from other Facebook-owned services and from Facebook Business 
Tools should be necessary.Facebook did not indicate what data and data 
processing procedures are necessary to mitigate the general dangers associated with 
using the Internet, both for services and for users, and which are used solely for this 
purpose. Preventative defence purposes such as the prevention of fraud and attacks 
on computer and communication systems, as presented by Facebook, for instance in 
relation to the prevention of automated software programmes (so-called "bots")®^®, are 
at best recognised as legitimate interests in Recitals 47, 49 of the GDPR (see below 
(5). 


cf. also with regard to the eomparison between WhatsApp and Faeebook data Hamburg Administrative Court, 
judgment handed down on 24 April 2017, p. 32. 
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713 The same applies ultimately to the research purposes mentioned in the Terms of 
Service. It is not clear here either that data collected from other Facebook services or 
Facebook Business Tools are essential for research purposes. 

(4) No justification for speciai purposes pursuant to Articie 6 (1 c)-e) GDPR 

714 The possibility of collecting personal data of users of the social network from Facebook- 
owned services and Facebook Business Tools pursuant to the Data Policy, including 
the combination of data with Facebook user accounts as well as use of any such data, 
is not justified under Article 6(1 c)-e) GDPR either. 

715 This applies if only because data processing may not take place in advance in the event 
that any of the situations or tasks governed by Article 6(1 c)-e) GDPR may occur or be 
transferred. Rather the respective special purpose must apply when the respective data 
processing is carried out. This is clearly not the case. 

(a) No legal justification pursuant to Article 6 (1 c) GDPR 

716 There is no legal obligation pursuant to Article 6(1 c) GDPR, for which the processing 
of data collected from Facebook-owned services or Facebook Business Tools is 
necessary pursuant to the Data Policy. 

717 It appears that Facebook's published legal bases and Data Policy require it to respond 
to legal requests from regulators, law enforcement authorities, and other executing 
authorities. Facebook then accesses and stores user data and shares them with the 
above-mentioned authorities in response to legal requests if Facebook believes in good 
faith that it has a legal obligation to do so. Facebook says it may also respond to legal 
requests if it believes in good faith that the response is mandatory under the law of the 
jurisdiction concerned, affects users in that jurisdiction and corresponds to 
internationally accepted standards. 

718 However, any required response to legal requests and an obligation to respond to these 
requests may not justify data being collected from Facebook-owned services or 
Facebook Business Tools or data being combined with Facebook user accounts. This 
data processing is not even covered by Facebook's own wording in the Terms of 
Service, which deals with data access, storage and transfer to the authorities, but not 
with the collection and combination of data. 

719 Article 6(1 c) GDPR also calls for a clear, precise and predictable legal basis for data 
processing, which must be in the public interest. No such legal basis is apparent here. 
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Data processing would have to be carried out only to the extent required by the legal 
obligation,®^® meaning that even "good faith" in a legal obligation is not sufficient. 

(b) No vital interests, Article 6 (1 d) GDPR 

720 It is not clear either that the collection and processing of personal data from Facebook- 
owned services and Facebook Business Tools on the basis of Article 6 (1d) GDPR 
could be justified in order to protect vital interests of the person concerned or another 
natural person. 

721 Facebook claims in the published legal basis that the “vital interests” it relies on for this 
processing include “protection of your life or physical integrity or that of others". 

722 This legal basis calls for a situation posing a concrete risk for life and limb in which the 
data subject is unable to give consent for physical or legal reasons.®®® Here, too, data 
processing cannot take place in advance in order to cover the abstract eventuality of 
any such situation occurring. 

(c) No public interest, Article 6 (1 e) GDPR 

723 The same applies to invoking public interests pursuant to Article 6 (1 e) GDPR, of which 
there is no evidence here either. 

724 Facebook refers in the published legal bases to tasks carried out in the public interest 
including "research for the benefit of society and to promote protection, integrity and 
security' where this is necessary in the public interest as laid down by Union law or 
Member State law to which it is subject.®®^ In its Data Policy, Facebook says that it uses 
the information it has to verify accounts and activity, combat harmful conduct, detect 
and prevent spam and other bad experiences, maintain the integrity of its products, and 
promote safety and security on and off Facebook Products. For instance, Facebook 
uses data to investigate suspicious activity or breaches of its Terms or Policies, or to 
detect when someone needs help. 

725 Furthermore, Facebook indicates in its Data Policy that it uses the information that it 
has (including from research partners it collaborates with) to conduct and support 
research and innovation on topics of general social welfare, technological 
advancement, public interest, health and well-being. For example, Facebook says it 
analyses the information it has about migration patterns during crises to aid relief 


Ehmann/Selmayr, GDPR, Article 6, para. 16; 

Auernhammer, GDPR, Art. 6 recital 22; Ehmann/Selmayr, GDPR, Art. 6, recital 17. 
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efforts. A hyperlink takes users to an English-language page on Facebook's research 
programmes. 

726 This does not justify the processing of data imposed that is collected from Facebook- 
owned services and Facebook Business Tools pursuant to Article 6(1 e) GDPR. The 
justification presupposes that the processing is necessary for a public task which is in 
the public interest. The data controller must be assigned a task by law the performance 
of which is in the public interest.This is not apparent in any of the above-mentioned 
"public interests". Neither can it be assumed that the data processing imposed is 
necessary in the public interest. 

(5) No justification because of overriding interests pursuant to Article 6 (1 f) 
GDPR 

727 Contrary to Facebook's view, the processing of data collected from Facebook-owned 
services and via Facebook Business Tools imposed in Facebook's Terms of 
Services®^^ is not justified for the balancing of interests pursuant to Article 6(1 f) GDPR. 

728 Data processing is permissible pursuant to Article 6 (1 f) GDPR for the purposes of the 
legitimate interests pursued by the controller or by a third party, taking the data 
processing principles governed by Article 5 GDPR into account, except where such 
interests are overridden by the interests or fundamental rights and freedoms of the data 
subject which require protection of personal data. 

729 The wording of the standard has not changed since Article 7(f) of Directive 46/95/EC. 
The entry into force of Article 6(1 f) GDPR does not bring about any substantive change 
in the facts at hand. The guidelines issued by the Article 29 Data Protection Working 
Party on the concept of the legitimate interest of the controller pursuant to Article 7 of 
Directive 95/47/EC®^'^ may therefore also be used as a basis for the examination of 
Article 6(1 f) GDPR. These guidelines are also referred to in the guidelines issued by 
the Article 29 of the Data Protection Working Party on automated decisions in individual 
cases, including profiling for the purposes of Regulation 2016/679, drawn up for the 
GDPR.®35 

730 According to the guidelines issued by the Article 29 Data Protection Working Party, the 
justification calls for comprehensive examination of the balance between the legitimate 

Auernhammer-Kramer, GDPR, Article 6, para. 14 
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Opinion 06/2014 on the concept of legitimate interest of the controller pursuant to Article 7 of Directive 95/46/EC" 
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interests of the controller or of a third party and the interests or fundamental rights of 
the data subject. In addition to determining the respective interests and rights 
concerned and their justification, the guidelines for further consideration also require 
key factors to be taken into account which are described in the evaluation of the 
balancing of the legitimate interests of the controller or third parties and the necessity 
of data processing for the representation of those interests 

• the evaluation of the balancing of the legitimate interests of the controller or third 
parties and the necessity of data processing for the representation of those 
interests,®^® 

• the consequences for data subjects, taking into account the nature of the data to be 
processed, the legitimate expectations of the data subjects, the position of the 
controller and of the data subject, including any dominant position, 

• any additional measures which, if interests and rights are not clearly balanced, are 
capable of striking a balance, including user-friendly appeals, additional 
transparency, data minimisation and data protection-friendly alternatives.®^® 


731 On this basis, a justification of the data processing imposed based on the factors to be 
included in the consideration is neither apparent for the data from Facebook-owned 
services (see (a), nor for the data from Facebook Business Tools (see (b). 

(a) Facebook-owned services 

732 The data processing for the recording of user data from the Facebook-owned 
companies WhatsApp, Oculus and Masquerade, that is possible according to 
Facebook's Terms of Service, and the combination of data generated when using 
Facebook.com with data generated using Facebook user accounts and the use of any 
such data is not justified by overriding legitimate interests of Facebook or third parties 
vis-a-vis the interests and rights of the user. This also applies to the combination data 
obtained through the use of the Instagram service offered by Facebook Ireland Ltd. 
with the data generated through the use of Facebook.com under Facebook user 
accounts, as well as their combined use. 


Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Article 7 of Directive 95/46/EC, p. 43 ff., [...] 

Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Article 7 of Directive 95/46/EC, p. 47ff., 51.; [...] 

Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Article 7 of Directive 95/46/EC, p. 52 ff., [...] 
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733 The processing of data collected from Facebook-owned services imposed is for the 
most part not covered by legitimate interests as they have been neither clearly 
articulated nor are they necessary (see i.). In weighing up the consequences for the 
users concerned, the key factors that need to be considered are the interest and right 
of users to the protection of their privacy and autonomy (see ii.). There are no protective 
measures apparent that strike a fair balance of interests (see iii.). 

i. Legitimate interests 

734 Both Facebook and third parties can, in principle, assert legitimate interests in relation 
to data processing within the Facebook Group. However, to a large extent, Facebook 
has neither sufficiently explained nor otherwise made clear why internal data 
processing within the group is necessary for the representation of these interests. 

• Facebook’s interests 

735 The goals Facebook has mentioned in these proceedings, namely Facebook.com’s 
personalisation, including targeted advertising, measurement and analytics purposes, 
user and network security as well as the research purposes and responses to legal 
requests referred to in the legal bases published, can in principle represent legitimate 
interests pursuant to Article 6(f) GDPR. According to the guidelines issued by the Article 
29 Data Protection Working Party, the term covers a broad spectrum of legitimate 
interests, ranging from interests that are null and void right up to very compelling 
interests, uncomplicated or contentious interests.®^® However, the key issue is whether 
the legitimate interest has been sufficiently clearly articulated to weigh up the balance 
of interests and whether legitimate interests apply in the present situation. 

o Legitimate interests have not been articuiated cieariy enough 

736 The legitimate interests have not been articulated clearly enough on this basis. In the 
present proceedings, Facebook presents legitimate interests only in general terms and 
merely repeats the information about legitimate interests in the legal bases referred to 
in its Data Policy. 

737 Accordingly, Facebook (also) refers to its legitimate interests with respect to Facebook- 
owned services for persons under the age of majority and persons who have a limited 
ability to enter into an enforceable contract, since the justifications of necessity for 
contractual performance and consent cannot be invoked in relation to them. In the case 
of minors, Facebook claims that personalisation and targeted advertising, as well as 
protection, integrity and security, and the provision of non-marketing communications 

Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Article 7 of Directive 95/46/EC, p. 31; [...] 
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are indeed legitimate interests. In addition, Facebook claims marketing interests for the 
promotion of Facebook-owned products and direct advertising as well as research 
interests necessitate the processing of data collected from Facebook-owned services. 
It says the processing of data collected from Facebook Business Tools is necessary 
for the interests in providing measurements, analytics and other company services 
when Facebook is the data controller.®'^^ 

738 This statement does not represent a sufficiently clear articulation of the legitimate 
interests that could be used to balance the interests and rights of the data subject. For 
it does not substantiate in detail Facebook's own interests, such as security interests 
or provide a differentiated explanation as to why data needs to be collected and 
recorded specifically from Facebook-owned services or why this data needs to be 
assigned to Facebook user accounts. Facebook does not explain what type of data 
processing is involved either, in particular the profiling used to personalise the service 
and for advertising purposes or what contribution the data collected from Facebook- 
owned services make. In this respect, Facebook merely claims in this particular case 
that the Decision Division refers to data processing as “profiling”.However, 
according to the guidelines issued by the Article 29 Data Protection Working Party, 
legitimate interests can only be asserted for certain data and certain types of data 
processing. Facebook declares in this respect that all data processing serves its 
overriding legitimate interests. Accordingly, Facebook's data processing terms also 
reserve the right to process any data, including data processing within the Group. 

739 Facebook carries the burden of proof in relation to the prerequisites of justification 
pursuant to Article 6 (1 f) GDPR. The Bundeskartellamt does not need to determine ex 
officio the interests possibly pursued by the company within its sphere or the individual 
data processing procedures ascribed to them or even their significance for the 
company in order to prove that no justification exists. This ensues both from the legal 
prohibition subject to permission under data protection law which all processing of 
personal data is subject to, and from the principle of the accountability enshrined in 
Article 5 (2) GDPR, which makes the controller responsible for compliance with the 
regulations governing lawful data processing. Article 24 (1) GDPR explicitly 
emphasises that the controller is obliged to demonstrate that processing is performed 
pursuant to the GDPR. Art. 30 GDPR says that the controller must maintain a record 
of processing activities under its responsibility in order to prove compliance with the 
provisions set forth in the GDPR. The controller himself must therefore not only ensure 
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that the processing complies with the GDPR, he must also be in a position to prove that 
he has undertaken everything necessary to achieve the objective and has taken 
suitable measures accordingly.®'^^ But also the antitrust provisions set forth in Section 
19 GWB do not oblige the antitrust authority to prove the justifications for anti¬ 
competitive behaviour within the framework of the principle of ex-officio investigation. 
Here, too, the norm addressee is responsible for explaining the circumstances within 
the company's sphere. To this end, the Bundeskartellamt has expressly requested 
Facebook to explain the circumstances on several occasions, in particular with the 
preliminary assessment notice sent to Facebook in December 2017, with previously 
submitted documents and in discussions. 

740 Facebook wrongly believes in this regard that the Decision Division assumes "abuse 
due to lack of justification" and that it did not investigate the conduct.®'^'^ In particular, 
Facebook fails to recognise that the conduct in this case is the actual, comprehensive 
data processing that has been imposed and carried out pursuant to the Terms of 
Service and the Data Policy and that it is this very conduct that requires objective 
justification. 

o The data processing imposed is not necessary 

741 It cannot be assumed following the investigations carried out by the Bundeskartellamt, 
regardless of Facebook's explanations, that the extent of data processing possible 
under the Terms of Service and the data processing actually implemented are 
necessary for the above-mentioned purposes. 

742 The guidelines issued by the Article 29 Data Protection Working Party say in relation 
to legitimate interests that data processing must be necessary for the intended 
purposes.®"*® The term also needs to be narrowly interpreted within the framework of 
legitimate interests and does not apply just because it is useful or expedient. Rather, 
data processing must be essential for achieving the purposes, and the purposes must 
not be achievable by any other means. According to the guidelines issued by the Article 
29 Data Protection Working Party, it needs to be considered whether there are any 
other data protection-friendly alternatives available - such as voluntary user options. In 
this respect, the definition of necessity does not need to be more broadly construed 
than in the previous justifications pursuant to Article 6 (1 b)-e) GDPR. On the contrary, 
the Article 29 Data Protection Working Party points out that the need for “necessity” is 
particularly relevant for Article 6 (If) GDPR in order to ensure that the processing of 


Plath, GDPR/Federal Data Protection Act, 3rd edition 2018, Article 24, para. 19 
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data based on legitimate interests does not lead to an inappropriately broad 
interpretation of the necessity of data processing in the first place.®'^® 

743 On this basis, the processing of data collected from Facebook-owned services is not 
necessary for the personalisation or individualisation of Facebook.com. It is true that 
the interest in high-quality personalisation and individualisation of the service provided 
by social networks is, in principle, important and that the quality and efficiency argument 
should be taken into consideration from the antitrust perspective. It is also 
acknowledged that each individual data is also beneficial (see above para. 702). 
However, data processing is not necessary for usefulness and efficiency. 

744 With regard to the special meaning of necessity, in the context of the legitimate interest 
pursuant to Article 6 (If) GDPR just as with Article 6 (1b) GDPR, the interests in the 
chosen business model of a personalised service financed with targeted advertising 
cannot lead to all data processing procedures that provide additional information about 
the individual user being necessary (see above para.692). It also needs to be pointed 
out in this context that Facebook can achieve a high degree of personalisation and 
individualisation with the data generated from Facebook.com itself. It has not been 
argued nor is it apparent what crucial contribution user data collected from other 
Facebook-owned services make towards accomplishing this goal that rules out a less 
intrusive measure - such as a user option. 

745 In the case of the Oculus and Masquerade services, the fact that they currently have a 
comparatively low level of penetration indicates that the processing of data is not 
necessary for personalisation purposes. However, the additional device-related data 
associated with these services, which can provide information about user behaviour on 
the devices with regard to online websites and apps, including those of competitors, is 
of great value even for a relatively small user base, since successful applications can 
be identified by competitors at an early stage. Irrespective of whether this circumstance 
is covered by the purpose of personalisation and individualisation, it is doubtful whether 
this can be regarded as a legitimate interest under antitrust law. In any case, however, 
it must be taken into account in the balancing of interests that competitive user data 
are also collected. 

746 The WhatsApp user information that is not currently used to "improve the product 
experience" or to "display more interesting advertising" on Facebook according to the 
WhatsApp FAQs,®'^^ is not necessary for the purposes claimed either. Even though the 


Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Article 7 of Directive 95/46/EC, p. 37; [...] 
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scope and purpose of the data transfer and the use of this data are ultimately unclear, 
also with regard to a potential integration of the services, for a start the current actual 
data processing shows there is no reason to assume that the data used for 
personalisation and individualisation purposes is absolutely necessary. This also 
applies to Instagram data which, after the service was transferred to Facebook Ireland 
Ltd., is not subject to any restrictions on combination or combined use of data under 
the identical Facebook and Instagram policies particularly for profiling. As indicated 
above, the existing connections between Instagram and Facebook.com do not mean it 
is necessary to process Instagram user and device-related data for the personalisation 
of the service and advertising on Facebook.com unless users have control (para.699). 

747 Insofar as in the present case the vaguely defined interest in the "consistency of the 
user experience" and in further integrating both services is to be claimed®'^®, the 
"justification" of this interest must be called into question under antitrust law. For 
integrating services - also de facto by integrating functionalities and shared user 
accounts including shared user data assigned to Facebook user accounts - is 
problematic under antitrust law. Integration can transfer and safeguard market power, 
can exclude other market players and create barriers to market entry for competitors 
such as Snapchat. 

748 For example, enabling users to communicate directly between the Facebook.com, 
WhatsApp, and Instagram services would create economies of scale by harnessing the 
direct network effects of each service. The creation of compatibility and an "end-to-end 
connection" neutralises the effect of direct network effects limited to the compatible 
networks. Switching to services is facilitated or becomes unnecessary, which greatly 
enhances the lock-in effect for all services and is a major barrier to switching from 
compatible services to alternative incompatible services. This results in the transfer of 
market power between the compatible services and to securing Facebook's market 
position. 

749 The combination of all user data associated with this would therefore constitute a 
significant competitive risk by creating further barriers to market entry and major 
obstacles for switching providers. Any such risk must in any case be taken into account 
in the balancing of interests vis-a-vis the interests and rights of users. From this point 
of view, the interests of marketing, the promotion of Facebook Products and direct 
advertising mentioned in Facebook's legal bases must also be deemed at the very least 


Cf. insofar the plans which have become known on the further integration of Facebook, WhatsApp and 
Instagram (source available in German 

onlv) https://www. welt.de/wirtschaft/webwelt/article187738456/Zuckerbera-plant-Verknuepfuna-von-WhatsApp- 
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sensitive under antitrust law. The extent of potential data processing, in particular with 
regard to Instagram and WhatsApp, but also with regard to the Group's other services, 
therefore cannot be deemed necessary for this purpose. 

750 Furthermore, it is not clear with regard to the alleged user and network security 
including the security aspects presented by Facebook such as the prevention of child 
abuse or terrorist activities why, irrespective of any concrete suspicion, a partially 
unlimited collection and use of data from other Facebook-owned services is 
necessary.®"*® Preventative defence purposes, such as the fight against fraud and the 
prevention of attacks on computer and communication systems, are recognised as 
legitimate interests in the Recitals of the GDPR. However, it can be clearly inferred 
from the Recitals to the GDPR that data processing which pursues preventative 
defence purposes is only permissible if it is limited to compellingly necessary measures 
and does not reach an intensity that is disproportionate to the purposes pursued.®®® 
Facebook did not indicate, as outlined above, which data and data processing 
procedures are necessary for the individual general dangers it mentions in relation to 
use of the Internet, both for services and for users, and which are only used for this 
purpose. As such, it is extremely doubtful that the unlimited combination of Instagram 
data and data generated with Oculus and Masquerade is necessary for security 
purposes. 

751 The Bundeskartellamt does not see either why the data WhatsApp currently transfers 
to Facebook is necessary for the alleged security purposes. It remains unclear what 
contribution the phone number provided to WhatsApp upon registration and the device- 
related information, the "last seen" information and the login data and features used to 
identify security threats or "malicious users”®®* make. It is not clear either why an event- 
driven combination is not sufficient for identification purposes. In a notice issued by 
Hamburg’s Data Protection Commissioner on 23 September 2016 - confirmed by 
Hamburg Administrative Court and Hamburg Higher Regional Court®®® in summary 
proceedings - Facebook Ireland Ltd. is prohibited the aforementioned data collection 
and storage on the basis of the previously applicable Federal Data Protection Act for 
lack of overriding interest, unless consent is given.®®® The additional processing of data 

cf. also with regard to the comparison between WhatsApp and Facebook data Hamburg Administrative Court, 
judgment handed down on 24 April 2017, p. 32. 

cf. Recital 47 sentence. 6 GDPR on fraud prevention: “strictly necessary”. Recital 49 on data and information 
security “strictly necessary and proportionate”;cf. also Harting, General Data Protection Regulation para. 439 

Facebook's submission in the proceedings before Hamburg Administrative Court, see judgment handed down 
on 24 April 2017, ref. 13 E 5912/16, p. 14, [...] 

Hamburg Administrative Court, judgment of 24 April 2017, ref. 13 E 5912/16, [...], Hamburg Higher Regional 
Court, judgment of 26 February 2018, ref. 5 Bs 93/17 

Statement of the Hamburg Commissioner for Data Protection and Freedom of Information of 23 September 
2016, [...] 
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generated from WhatsApp reserved in Facebook's Terms of Service for security 
purposes is even less necessary. 

752 The largely unrestricted data processing from corporate services is not necessary for 
internal Group measurement and analytics purposes either. In particular, Facebook 
cannot invoke the privilege of intra-group data exchanges for this purpose (see above, 
para. 608ff.). It is true that the GDPR recognises a limited "group privilege" in Recital 
48 in the context of the legitimate interests of Article 6(1 f) GDPR. It says controllers 
that are part of a group of undertakings or institutions affiliated to a central body may 
have a legitimate interest in transmitting personal data within the group of undertakings 
for internal administrative purposes, including the processing of clients' or employees' 
personal data. The European Data Protection Legislation therefore for the first time 
expressly recognises the necessity of internal data transfers within groups of 
companies and expressly emphasises the interest data controllers have in such 
transfers. However, it is still necessary to carry out a case-by-case examination and to 
balance the legitimate interests of the company in the intra-group transfer of data vis- 
a-vis the interests of data subjects in ensuring that their data are not transferred within 
groups of companies.®^"^ 

753 The data exchange possible under the Terms of Service is not limited to internal 
administrative purposes according to Facebook's own statement but serves mainly 
other interests. It is not clear why data processing of this magnitude is needed for 
internal analytics purposes. This also applies to the data that Facebook collects from 
WhatsApp and which, according to Facebook®®®, is only used for internal analytics 
purposes, for instance, to determine the number of users. Apart from the fact that this 
statement is not reflected in the Terms of Service, it is not clear either why data need 
to be collected and assigned to Facebook user account at Facebook Ireland Ltd in 
order to determine the number of users. Hamburg’s Data Protection Commissioner 
prohibited Facebook Ireland Ltd. from collecting and storing WhatsApp data on the 
basis of the previous Federal Data Protection Act (BDSG) with judicial confirmation and 
made this subject to the requirement of consent.®®® 

754 The asserted research interests are only mentioned in general terms in the legal bases. 
It is not clear why, in addition to the Facebook data, the data of other Facebook-owned 
services are absolutely necessary for this purpose. The same applies to the legal 


Voigt, Konzerninterner Datentransfer - Praxisanleitung zur Schaffung eines Konzernprivilegs (available in 
German only), CR 2017, 428 (429). 
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requests mentioned in the legal bases. In this respect, too, it is not apparent why data 
need to be collected from Facebook-owned services - which are collected for no 
particular event. 

• Legitimate interests of third parties 

755 Pursuant to Article 6(1 f) GDPR, not only the legitimate interests of Facebook, but also 
the legitimate interests of third parties need to be considered when balancing interests. 
In this respect, Facebook points out that not only the legitimate interests of the 
commercial partners, but also those of the broader community of Facebook users need 
to be taken into account. This would lend more weight to Facebook’s legitimate 
interests. The wider community of Facebook users, for instance, has a strong interest 
in the security and protection of the Facebook network and in ensuring that other users 
do not abuse the network.®®^ 

756 From the Bundeskartellamt's perspective, in particular advertisers who want to buy 
targeted advertising from Facebook, as well as other partners who are active on the 
other market sides of the personalised service Facebook.com, may have legitimate 
interests as third parties. The same applies to a possible interest of the general public 
according to the guidelines issued by the Article 29 Data Protection Working Party.®®® 
However, Facebook users, who Facebook refers to in this context as the "wider 
community", are hardly to be regarded as third parties, since the entire broad 
community is affected by data processing. They can therefore only be taken into 
account when assessing the interests and rights of the data subjects. However, it is 
extremely doubtful that the users have to subordinate themselves to the community 
interest defined by Facebook with regard to the protection of their privacy and their right 
to self-determination. 

757 All in all, the interests of third parties claimed here are identical to those claimed by 
Facebook itself. Therefore the same applies to the question whether the third parties 
have the same legitimate interests as Facebook. In particular, data processing must 
also be necessary for the interests of third parties. This is not the case in view of the 
congruence of interests for data processing from the Group's own services with regard 
to the interests of third parties in personalised advertising. Reference is made to the 
information above. 

758 Finally, this also applies to a public interest in the prevention of illegal or punishable 
acts, such as child abuse, frequently mentioned by Facebook. In its guidelines on 


657 [...] 

666 Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Article 7 of Directive 95/46/EC, p. 36; [...] 
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legitimate interests, the Article 29 Working Party draws attention to situations in which 
a controller goes beyond his specific legal obligations under laws and regulations in 
order to contribute to law enforcement or support private actors in their efforts to combat 
illegal activities, such as money laundering, grooming of children for sexual purposes 
or illegal online file sharing. In such cases, however, in the view of the Article 29 Data 
Protection Working Party, it is particularly important to ensure that the boundaries of 
Article 6(1 f) GDPR are fully respected. It is not evident why intra-group data processing 
is necessary to safeguard this interest. 

• Interests and rights of users 

759 Finally, the interests and rights of the data subjects, in this case Facebook users, must 
be taken into account and balanced. 

760 This includes in particular users' interest and right to maintaining their informational 
self-determination and their privacy. In its opinion on legitimate interests, the Article 29 
Data Protection Working Party also emphasises this in particular, since in times of 
increasing distortions in the field of “information sovereignty”, in which governments 
and business institutions amass unprecedented amounts of data on individuals and are 
increasingly able to create detailed profiles predicting their behaviour (thereby 
exacerbating information imbalances and undermining personal autonomy) it is all the 
more important to ensure that the interests of individuals in the protection of their 
privacy and autonomy are safeguarded.®^® 

761 In addition, all other relevant user interests that are affected by data processing must 
be taken into account.®®® In this respect, Facebook points out that users' interest in 
being offered the most effective and high-quality service possible that is free of charge 
because it is financed by advertising, must be taken into account first and foremost.®®^ 
The Bundeskartellamt also regards this as a legitimate interest and takes this into 
account when balancing interests. However, Facebook's statement does not indicate 
that users must be denied the right to influence representation of their own interests in 
order to be able to use the effective and high-quality service offered in their own interest 
with regard to the data processing procedures from Facebook-owned services affected 
here. In this case too, data protection-friendly alternatives that include, for instance, 
corresponding voluntary options for users, are not deemed necessary. 


Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Article 7 of Directive 95/46/EC, p. 38; [...] 

Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Article 7 of Directive 95/46/EC, p. 38; [...] 
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762 And if the user community is to be regarded as an interest group which has an interest 
in user and network security that needs to be taken into account, it has neither been 
claimed nor is it apparent that data processing is necessary for this interest for the 
assessment under Article 6(1 f) GDPR - as outlined above. 

763 In all other respects, the interests of the data subject do not need to be "legitimate", 
contrary to the interests pursued by the controller or by a third party, as highlighted by 
the wording of Article 6(1 f) GDPR. This means, for instance, that even persons acting 
unlawfully or "maliciously" cannot be subject to disproportionate interference with their 
rights.®®^ 

ii. Balancing of interests with regard to the consequences for the affected 
users 

764 The legitimate interests claimed by Facebook in the processing of data from Facebook- 
owned services cannot outweigh the legitimate interests and rights of Facebook users. 

765 Although Facebook's commercial interests are relevant to fundamental rights in the 
context of entrepreneurial freedom, this only applies if it can be assumed data 
processing is necessary for interests allegedly pursued.®®^ However, even if it could be 
assumed that data processing was necessary, the data processing in the Group is not 
sufficiently balanced pursuant to Article 6 (1 f) GDPR, considering how it affects the 
interests and fundamental rights of data subjects. 

766 Contrary to Facebook's view, "actual" negative effects are not the only decisive factor 
here. In this respect, it cannot be argued that the only negative effect for users is the 
fact that advertisements are shown and that this, which can at best be described as a 
nuisance, does not cause any harm.®®'^ On the contrary, Facebook demonstrates the 
gross imbalance that exists between the nature and extent of data processing carried 
out without users' consent and the purpose pursued by this, above all, which is to 
display granular personalised advertisements on a service that is also personalised. 

767 According to the guidelines issued by the Article 29 Data Protection Working Party, 
specifically foreseeable adverse results are significant as the term "consequences" 
used by the Working Party is much broader than "harm" or "disadvantage" for one or 
more specifically several data subjects. Rather, this refers to all possible (potential or 


Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Article 7 of Directive 95/46/EC, p. 38 [...] 

Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Article 7 of Directive 95/46/EC, p. 44 [...] 

664 j j 



219 


actual) consequences of data processing.®®^ The Article 29 Data Protection Working 
Party has therefore developed further key factors for the impact assessment in order 
to identify and assess the impact on the interests and rights of data subjects and thus 
the seriousness of the invasion of privacy and self-determination. They include in 
particular 

o the type of data 

o how the data is processed, 

o data subjects’ justified expectations and 

o the position of the controller and the data subjects.®®® 

768 In its Recitals, the GDPR also emphasised in particular the "reasonable expectation of 
the data subjects" based on the "relevant and appropriate relationship with the 
controller". 

769 When these key factors are considered as a whole, the disadvantageous 
consequences for users' privacy and self-determination outweigh the largely unjustified 
and therefore less important interests of Facebook. 

• Type of data 

770 This initially applies to the data affected by intra-group data processing, which are to 
be classified as sensitive data. This includes sensitive data because the data 
processing imposed also involves special categories of data, communication data and 
location data.®®^ Users are also tracked across services and devices as data from all 
corporate services are used, which includes the particularly popular services WhatsApp 
and Instagram, i.e. the Facebook services involve a large amount of sensitive data. 
The protection of privacy and autonomy takes on a high priority in view of the special 
sensitivity of this data. 

771 Sensitive data are also affected in relation to the individual services examined. All of 
the above data categories are initially affected when data is collected from the 
Facebook-owned Oculus and Masquerade services. In particular, these services 
collect and store a wide range of device-related information, including location data. 
This can also easily affect special categories of data generated from websites visited, 
apps used and locations. As outlined above (584ff.) it is therefore sufficient that this 


Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Article 7 of Directive 95/46/EC, p. 47 [...] 

Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Article 7 of Directive 95/46/EC, p. 43ff. [...] 

Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
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feature results indirectly from the data. In balancing interests, it must, however, also be 
taken into account that the data is combined with the user data which Facebook.com 
already has, thus providing a full profile including special data categories. 

772 WhatsApp data are also closely associated with the communication behaviour of users 
which means these data too are potentially sensitive. This holds true despite the 
unclear information provided by WhatsApp on the extent to which WhatsApp messages 
are shared and used and therefore completely vague wording of Facebook's Terms of 
Service. Data are also collected by Facebook Ireland Ltd. on the type and frequency of 
WhatsApp features used. This includes the communication contents of the “Status” 
function in which users can post news about their current activity, location etc. including 
photos for all their contacts. This cannot be deemed “published” and therefore less 
sensitive since the recipients consistently comprise a limited group of persons. 
Features also include the telephone number and a large number of other device- 
identifying data that ensure users can be traced on the Internet and that the data can 
be assigned to their Facebook user account. 

773 Last but not least, the processing of personal data generated from Instagram involves 
sensitive data for the most part. This applies to all communication data and contents of 
users, contacts, device-related information, location information, signal information, to 
name but a few. The large volume of browser- and device-related data makes it 
possible to identify users and ensures they can be tracked on the Internet even though 
the relevant users have no control mechanisms. 

774 With Instagram, users’ consent to the processing of special data categories is 
incidentally only obtained for data they actively enter themselves. However, data on 
users’ online behaviour are collected via cookies and device-related data, indicating 
that this also involves special data categories. Instagram's Data Policy which is 
identical to Facebook’s Data Policy does not contain any limitations whatsoever 
regarding the use of data for purposes pursued by Facebook.com but describes the 
services as a shared offering. 

• Type of data processing 

775 This type of data processing represents a serious invasion of the data subject's privacy. 
This is because data processing already reaches a very high level in terms of type and 
quantity with the user- and device-related data that Facebook-owned services account 
for. 

776 Another particularly problematic aspect is that the vast majority of the data is collected, 
combined and used for detailed profiling aimed at personalising and individualising the 
Facebook.com service and the ads displayed. Although the provision of a personalised 
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social network may usefully involve profiling, the processing of data from Facebook- 
owned services leads to a massive additional invasion of privacy, given that profiling is 
supplemented by tracking the users concerned across a vast number of websites, 
locations, devices and services.®®® To this end, the data collected are also used for the 
purpose of browser and device fingerprinting. 

777 The investigations carried out by the Bundeskartellamt show that the combination of 
data from Facebook-owned services is of major significance because [...] people use 
Facebook.com and Instagram as well as Facebook.com and WhatsApp in parallel. In 
the first quarter of 2018, more than [...] % of the monthly and daily active Facebook 
users were also using WhatsApp and more than [...] % of the daily Facebook users 
were also using Instagram. In addition, there are less widespread services, each of 
which is also used in parallel to Facebook.com, and there is a high probability that 
Masquerade, for example, is being used in parallel with Instagram. This makes it clear 
that users are tracked en masse across all websites, devices and services used, 
particularly for marketing and advertising purposes. In any such case, the Article 29 
Data Protection Working Party also thinks that this can only be justified under data 
protection law by means of voluntary consent.®®® 

• Users’ reasonable expectations 

778 The processing of data collected from Facebook-owned services imposed does not 
correspond to the reasonable expectations of data subjects based on their relationship 
with the controller either, which are particularly emphasised in Recital 47 of the GDPR. 
The "reasonable" expectations users have regarding stricter confidentiality, already 
regarded as a key factor by the Article 29 Data Protection Working Party, must be 
assessed in particular on the basis of the nature of the relationship and on the service 
provided. Contrary to the view held by Facebook®^®, it cannot be assumed with regard 
to the Facebook Business Tools either that Facebook.com users are aware that a large 
amount of data from their entire Internet usage behaviour is assigned to their Facebook 
user accounts and are used for personalisation and other purposes. 

779 For a start, the relationship between users and the various Facebook services is 
determined in particular by the log-in to the service-related account. At the time the 


See else Article 29 Data Protection Working Party, Guidelines on Automated individual decision-making and 
Profiling for the purposes of Regulation 2016/679, p. 16; Article 29 Data Protection Working Party, Opinion 
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data is collected from the social network by another Facebook-owned service, such as 
WhatsApp or Instagram, for which users log in with a separate account, users need not 
reasonably expect the data to also be combined with the Facebook user account and 
to be used for all purposes pursued by the social network. 

780 No such expectation can be derived solely from the fact that the services are part of 
the same group of undertakings. Not all users know precisely what services belong to 
Facebook. This applies in particular to lesser-known services such as Oculus and 
Masquerade. Facebook does mention these services in its Data Policy. However, users 
regularly only take fleeting notice of them - as is to be assumed with general terms and 
conditions. In this particular case, users must also press a hyperlink in the Data Policy 
which takes them to another page listing the companies belonging to the group. These 
include in particular the services WhatsApp and Instagram and a large number of other 
companies.®^^ If users click on any of these services, they are taken to the terms of use 
of these services.However, in order to understand which of their data is being 
processed, users must read the terms of use of each individual service in order to 
assess what data are collected under that service and are combined with their 
Facebook usage data. The Article 29 Data Protection Working Party therefore rightly 
points out that instead of relying on the "small print", the factual context must be taken 
into account.®^^ 

781 The specific WhatsApp and Instagram services, by their very nature and presentation, 
also create an expectation of greater confidentiality. This is because Instagram and 
WhatsApp are communication services that regularly send content and messages to a 
narrower audience defined by the user. WhatsApp also sends messages in encrypted 
form, conveying the impression of a high level of confidentiality for all other data. As a 
communication service, Instagram also creates expectations as to how any such data 
and contacts are handled. There is a high level of publicity on Instagram, but this is not 
consistent, as here too users can limit the circle of recipients. 

782 All things considered, the extent of possible data processing from all services of the 
Facebook Group does not correspond to users' reasonable expectations. This is 
especially true in view of the fact that users are unable to assess what data are 
processed on Facebook in which combination with what meaning or what the 


List of the “Facebook companies” available under https://de-de.facebook.eom/help/111814505650678 (last 
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assessment options are. Even if it can be assumed that the average Internet user can 
reasonably expect some form of tracking to take place with other services for most 
online services, they need not expect the level of intensity, which is possible according 
to the Terms of Service, nor need they expect their data to be continuously combined 
with Facebook user accounts. 

• Position of the controiier and users 

783 After all, Facebook's position vis-a-vis users means that the need for protection against 
the massive invasion of privacy associated with internal data processing within the 
Group is particularly high and must take precedence over Facebook's interests. As a 
multinational company with a dominant position in the market, Facebook has the 
negotiating power to impose extensive data processing unilaterally on users. 

784 According to the opinion of the Article 29 Data Protection Working Party, the dominant 
position must definitely be taken into account in respect of the balancing of interests. It 
is important to consider whether the controller is an individual, a smaller organisation, 
a large multinational or a public body. Depending on the particular circumstances 
involved, its position may be more or less dominant in relation to the data subject. A 
large multinational may, for instance, have more resources and bargaining power than 
the individual data subject; it may therefore be in a better position to impose on the 
data subject what, in its view, is in his or her “legitimate interests”. This may be all the 
more true if the company holds a dominant position in the market. Just as consumer 
protection and competition law help to ensure that this power is not abused, data 
protection law can also play an important role in ensuring that the rights and interests 
under data protection law are linked to the assessment of abuse under antitrust law.®^® 

785 On this basis, it is obvious that Facebook has a monopoly-like position on the market 
for social networks in this particular case (see para. 374ff.) and that the scope it has for 
data processing gives it special bargaining power, meaning it can assert its interests 
unilaterally. Facebook's statement also shows that the company imposes unilaterally 
on users what it considers to be in their "legitimate interest". Facebook, for example, 
repeatedly emphasises in its submission that the personalisation and individualisation 
of the service and advertising are in the users' interest and that users benefit from 
them.®^® It is also evident from shifting the legal basis from the provision of the service 
subject to consent to the alleged necessity for the extensive contractual objects 
unilaterally imposed by Facebook in the Terms of Service that the company is making 
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extensive use of the existing scope for negotiation and data processing in order to 
pursue its own interests. Facebook does not accord users the right of self- 
determination over their own interests regarding processing within the Group. It must 
also be taken into consideration, as outlined above, that intra-group data processing 
from other services involves the risk of further strengthening Facebook’s market power 
vis-a-vis users by transferring this market power to other services - Instagram in 
particular - by spying out user behaviour in the case of competitive offers in order to 
ward off aggressive competition. This would strengthen the bargaining power and the 
possibility of imposing data processing terms unilaterally. 

786 It must also be taken into consideration in relation to Facebook’s dominant position in 
the market that the majority of persons using Facebook.com, Instagram and WhatsApp 
but also Masquerade are adolescents or young, inexperienced people who frequently 
have no reservations about and have full faith in online services and are unable to 
assert their interests vis-a-vis a multinational undertaking that has a dominant position 
in the market. An online study conducted by the broadcasting corporations ARD/ZDF 
in 2017 showed that 14 to 19-year-olds (90 percent of all respondents) make up the 
largest group of WhatsApp users followed by 14 to 29-year-olds (87 percent of all 
respondents). In the group of 30 to 49-year-olds, only 72 percent of the respondents 
are still using the service; 41 percent of 50 to 69-year-olds and 13 percent of the over 
70s said they were using WhatsApp.The number of under-19-year-olds using 
Instagram is also rising sharply. Around 37 percent of Instagram users are aged 
between 14 and 29. Instagram is showing a strong growth trend. Whereas Instagram 
had around 9 million users in Germany in 2016, the number of users had risen to 15 
million by 2017. According to public statistics, the strongest growth trend is among the 
group of 14-19-year-olds at 16 percent.®^® 

ill. Lack of protective measures 

787 And last but not least, Facebook has neither claimed nor is there any evidence to 
suggest that additional protective measures have been taken in relation to the 
processing of data collected from Facebook-owned services in a bid to create a fair 
balance of interests. 

788 As such, it is initially about observing the so-called horizontal provisions set forth in the 
GDPR consisting in general data protection obligations, inter alia, regarding 
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transparency and proportionality.®^® However, this does not mean that in itself it is 
always sufficient to observe these horizontal requirements in order to ensure 
processing is necessary for the purposes of legitimate interests pursuant to Article 6 (1 
f) GDPR. Rather, in cases in which it is not clear which legitimate interests are 
overriding, additional measures that extend beyond observance of the horizontal 
requirements may need to be taken in order to balance interests. According to the 
guidelines issued by the Article 29 Data Protection Working Party, one of these 
additional measures could, for instance, be providing a user-friendly, accessible 
mechanism that would enable the data subjects to object unreservedly to the 
processing of their data.®®® 

789 The Article 29 Data Protection Working Party also points out technical and 
organisational measures for ensuring that the data cannot be used for measures 
associated with individuals ("functional separation"), increased use of anonymisation 
systems, aggregation of data, technologies for strengthening privacy, privacy by 
design, assessing the consequences for privacy and data protection, increased 
transparency, a general, unconditional right to refuse data processing, data portability 
and similar measures. 

790 On this basis, the Bundeskartellamt sees in this case no relevant data processing in 
which the balance of interests is unclear. On the contrary, on the basis of the key factors 
outlined above, there is a gross imbalance between the extent of data processing and 
the largely non-legitimate interests of Facebook. Another aspect worth noting in this 
case is that there is no evidence that protective measures have been taken in 
connection with the processing of data collected from Facebook-owned services. From 
the Decision Division’s perspective, this shows that the horizontal requirements are not 
being met either. 

791 This applies in particular to the transparency obligation regulated in Article 5 (1 a) 
GDPR with regard to the processing of data collected from Facebook Business Tools, 
which also applies to the extent to which personal data are processed and will continue 
to be processed in the future. The principle of transparency also presupposes that all 
information and messages on the processing of these personal data are given in 
transparent, intelligible and easily accessible form, using clear and plain language.®®^ 


Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Article 7 of Directive 95/46/EC, p. 52; [...] 

Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Article 7 of Directive 95/46/EC, p. 53; [...] 

cf. Recital 37 GDPR. 
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792 The Data Policy governing Facebook-owned services provides some information about 
the collection and processing of data for the purposes of Facebook.com. However, it 
takes several clicks to access this information and it is not provided in Facebook's Data 
Policy itself. Users need to switch back and forth between the Data Policies in order to 
receive information about all of the data Facebook combines with Facebook-owned 
services. It is not clear from WhatsApp’s Data Policy either to what extent WhatsApp 
messages are used to enhance the product experience on Facebook.com. Instagram 
does not provide any information about the extent to which data are used for 
Facebook.com. In this respect, mutual reference is made to the same general formula 
which says that data are processed across the Facebook Companies. 

793 There are no user-friendly options available enabling users to object to the processing 
of data from Facebook-owned services. It is even hard for users to exercise their right 
to object to the processing of their data based on Article 6 (1e) and 1f) GDPR pursuant 
to Article 21 GDPR in this case since it is unclear in the legal bases published by 
Facebook what data processing procedures are based on what legal basis. All 
objections - with the exception of minors - can be refuted according to Facebook’s 
Terms of Service by claiming data processing is necessary for performance of the 
contract. 

794 There do not seem to be any provisions governing retention periods or any other data 
minimisation measures. Unlike Facebook partners, users do not even have the option 
of disabling targeted advertising regarding data collected from Facebook-owned 
services. There are therefore no mechanisms available whatsoever that give users 
effective control over the cross-service combination of their data.®®^ In this respect, 
Facebook merely points out that users are not compelled to use the services of 
Facebook Companies. In addition, Facebook even states in the present proceedings 
that refraining from using Facebook is the only reasonable response for users who do 
not wish to avail themselves of a personalised service. Facebook therefore explicitly 
rejects the possibility of self-determination and control on the part of users. 

795 Facebook's legal bases only refer to protective measures for minors, which, however, 
only relate to one aspect of the consideration and ultimately cannot be used as 
justification for data processing from other services that are not absolutely necessary 
for the purpose indicated. 


cf. in this context aiso exampie 26 provided by the Articie 29 Data Protection Working Party, Opinion 06/2014 
on the legitimate interests of the data controller pursuant to Article 7 of Directive 95/46/EC , p. 86 [...] 
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(b) Facebook Business Tools 

796 On the basis of the principles outlined above, the collection and combination of 
personal data from third-party websites and apps that use Facebook Business Tools 
offered by Facebook, is not justified pursuant to Article 6 (1 f) GDPR. 

797 The data processing imposed by third-parties via Facebook Business Tools is for the 
most part not covered by legitimate interests since it has neither been clearly articulated 
nor it is necessary (see i.). In weighing up the consequences for the users concerned, 
the key factors that need to be considered are the interest and right of users to the 
protection of their privacy and autonomy (see ii.). No protective measures have been 
implemented so far that strike a fair balance of interests (see iii.). 

i. Legitimate interests 

798 Facebook has for the most part failed to clearly articulate legitimate interests that might 
be considered necessary for data processing via Facebook Business Tools to the 
extent possible according to the Terms of Service. 

• Facebook’s interests 

799 The personalisation goals pursued by Facebook.com and invoked in the present case 
in relation to the processing of data collected from Facebook Business Tools, including 
targeted advertising, measurement and analytics purposes, user and network security, 
as well as the provision of "accurate and reliable reporting to our advertisers, 
developers and other partners, to ensure accurate pricing and statistics on 
performance and to demonstrate the value that our partners realise using Facebook 
Company Products”,®®^ may, in principle, represent legitimate interests under Article 
6(1 f) GDPR. However, as outlined above, the key issue is whether the legitimate 
interest has been sufficiently clearly articulated to weigh up the balance of interests and 
whether legitimate interests apply in the present situation. Facebook has not clearly 
articulated its interests although it is required to do so nor is it assumed in relation to 
the individual Facebook Business Tools that data processing is necessary in the first 
place. 

o Legitimate interests have not been articuiated cieariy enough 

800 In the present proceedings, Facebook merely states, as explained above, that the data 
processing carried out by Facebook, including the processing of data collected from 
Facebook Business Tools, was not only necessary for the performance of the contract, 
but was also justified by Facebook’s overriding interests. Facebook says it had a 
legitimate interest in processing data also from third-party sources for the purpose of 


Facebook legal bases, https://www.facebook.com/about/prlvacv/leaal bases, [...] 
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personalising its service and for advertising and analytics purposes in order to 
safeguard financing of the service. Furthermore, it says the collection and processing 
of data from third-party sources was indeed justified by legitimate interests in so far as 
they serve to promote network and user security. Facebook claims data processing for 
security purposes was essential in order to guarantee general operability. 

801 The processing of data collected from Facebook Business Tools is justified in the legal 
bases published, as outlined above (para. 631), in addition to the necessity for the 
performance of the contract and consent to the use for personalised advertising, with 
the provision of measurement and analytics services as a legitimate interest, but only 
to the extent to which Facebook is the data controller. The Facebook Business Tools 
Terms provide, as outlined above (para. 136), that Facebook processes data on behalf 
of the controller although this has not been effectively agreed upon, in order to measure 
the effectiveness of advertisements and Facebook Analytics through the use of the 
Facebook pixel, SDKs or other interfaces. This assigns sole data responsibility to the 
third-party providers for the purposes of providing campaign reports and analyses and 
providing insight into customers and their use of apps, websites, products and services. 

802 Facebook also invokes a legitimate interest in "providing accurate and reliable reporting 
to our advertisers, developers and other partners, to ensure accurate pricing and 
statistics on performance and to demonstrate the value that our partners realise using 
Facebook Company Products” in its legal bases for the processing of data collected 
from the same tools and regarding "other business services". The Facebook Business 
Tools Terms indicate in Paragraph 5 iii-v that Facebook uses the data collected via the 
Facebook Business Tools consistently for personalisation purposes, security aspects, 
and research and development purposes and to improve Facebook products.®®"^ Under 
the Facebook Platform Policy, which Facebook also refers to, Facebook is given the 
option of analysing the third-party website and app specifically indicating "We can 
analyze your app, website, content, and data for any purpose, including commercial” 
when using social plugins, for example.®®® 

803 Even this statement by Facebook does not represent a sufficiently clear articulation of 
the legitimate interests that could be used to balance the interests and rights of data 
subjects. For Facebook does not specifically substantiate its own interests - such as 
the content or relevance of “pricing” or “performance statistics” for any of the above- 


https://www.facebook.com/leaal/technoloav terms , [...] 

see Paragraph 7.1 to 3 of Facebook Platform Policy, https://developers.facebook.com/pollcv/: “Things you 
should know: 7.1: We can analyze your app, website, content, and data for any purpose, including commercial”, 
7.2: We can monitor or collect data related to your use of SDKs; 7.3: We will use information we receive from 
you or in connection with your Platform integration pursuant to our Data Policy. (...).“, [...] 
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mentioned services nor does it provide a differentiated explanation as to why data 
needs to be collected from the various Facebook Business Tools or why the data needs 
to be assigned to Facebook user accounts for these purposes. Facebook does not 
explain the type of data processing involved either, in particular the profiling used to 
personalise the service and for advertising purposes or indeed what contribution the 
data collected from Facebook Business Tools makes. 

804 Rather, Facebook declares once again for all Facebook Business Tools, both in its 
statements in the present proceedings and in its various related policies, that all data 
processing is possible and necessary for a variety of generally defined legitimate 
interests. 

o The data processing imposed is not necessary 

805 It cannot be assumed in relation to Facebook Business Tools based on the 
investigations carried out by the Bundeskartellamt that the extent of data processing 
possible under the Terms of Service and the data processing actually implemented are 
necessary for the above-mentioned purposes. 

806 As outlined above (para. 139ff.) the integration of Facebook Business Tools gives 
Facebook direct access to comprehensive data about users and their usage behaviour 
from the respective providers who use Facebook services. A "Like" button, the "Share" 
or the "Facebook Login" button shows users that Facebook Business Tools have been 
embedded. However, the interface does not necessarily have to be visible to users, as 
is usually the case, for example, when the Facebook pixel is embedded on the website 
in the measurement and analytics tools. 

807 In the opinion of the Bundeskartellamt, no data flow is necessary at all or to the extent 
imposed and practiced when users access the website or app without being able to 
exercise any control. This data does not need to be assigned to the respective 
Facebook user account or used for the interests and purposes asserted by Facebook. 

Social plugins 

808 This applies first and foremost to the social plugins, which enable Facebook users to 
communicate directly with their network on Facebook from third-party websites or apps. 
On the opposite (market) side, Facebook gives the operators of websites or apps the 
opportunity to increase their own reach through advertising by using plugins which 
promote the website on Facebook.com. What is more, third companies can use the 
Facebook analytics product "Sharing Insight" to obtain information about the websites' 
performance on Facebook.com when users click the "Like" of "Share" button. They 
make it possible to track user activities on the website and the URL of the previously 
visited website. 
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809 The provision of a "Like" or "Share" button or any other social plugin for Facebook users 
and third party companies does not (see above 703), require any data flow to Facebook 
about the use of the website unless the user interacts with the button. Only when the 
user clicks on the button does a certain data record become necessary, which enables 
data to be assigned to the Facebook user account under which it is to be distributed on 
Facebook.com. Only then are the measurement and analytics purposes of the social 
plugins affected. The analytics product "Sharing Insights", which is crucial in this 
respect, requires the user to interact with the plugin in order to trigger measurable 
communication on Facebook.com. The fact that a social plugin has been embedded 
does not imply the simultaneous use of measurement and analytics products within 
Facebook Analytics or the use of advertisements on Facebook. There is hence no 
reason to assume it is necessary for the functionalities of social plugins. 

810 Facebook cannot justify direct access to data on third-party websites and apps, in 
addition to the above-mentioned interests and purposes, with the fact that it can keep 
the plugin technically up-to-date without any need for the third-party websites or apps 
to do anything. It is not clear to what extent a large amount of data assigned to the 
Facebook user account about user behaviour on a third-party website needs to flow 
each time a user accesses the website. The same applies to the direct data flow to 
Facebook without a detour via the embedded website or app. Facebook cannot claim 
that this prevents third-party websites and apps from receiving the personal data 
Facebook obtains through the data-combining process.®®® No protective function is 
discernible in view of the data collected and used by Facebook for its own commercial 
purposes, which are not necessary for the purposes of the functionality for users or 
third-party providers. 

811 Nor do the other social networking purposes mentioned in the Data Policy and in the 
various documents referred to for which this data can be used indicate the extent to 
which additional extensive data collection is necessary for an unlimited number of 
websites and apps via social plugins and why this cannot already be achieved with the 
extensive data processing on Facebook.com itself. The same applies to security and 
research purposes. In this respect, reference is made to the statement on Facebook- 
owned services (see above para. 750ff.). To claim it is useful for the purposes of the 
social network - as outlined above - is not sufficient. 

Facebook Login and Account Kit 

812 Data processing via the Facebook Login and Account Kit when accessing the website 
or app without the user having to press the button is not required either for the purposes 

686 |- j 
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indicated by Facebook. Essentially the same considerations apply as for the social 
plugins. 

813 This is because the functionality of these interfaces is essentially identical: Third-party 
websites may offer a "Facebook Login" on their site that enables users to log in to the 
website using their Facebook registration data or by entering their mobile phone 
number or e-mail address (so-called "Account Kit").®®^ This means that users do not 
have to register with a new login name and password each time they sign up with a 
website. Users can also transfer personal data to the app to avoid having to create a 
new user profile when they sign up with a new website or app. 

814 By integrating the Facebook Login, Facebook offers the following advantages to 
websites or apps: First of all, embedding the Facebook Login makes it easier to attract 
new users who can register quickly and easily on the respective website/app.®®® One 
particular advantage for companies is that users log on to Facebook.com using their 
"real identity" and not under a pseudonym.The Facebook Login also gives the third- 
party website/app access to additional usage data. This means the website/app has 
access to the "public profile", the primary e-mail address and the users’ list of friends®^° 
as well as about 30 additional pieces of user information after going through 
Facebook’s internal "review process”. Facebook advertises the "Facebook Login" 
product on the Internet so that the company can collect information about the user that 
would otherwise „be complex or arduous to collect via your own registration form”.®®^ 

815 Furthermore, the Facebook login can be combined with other functionalities, in 
particular various other social plugins and the so-called “Graph API” due to the 
requirement of the Facebook SDK (also for websites in the form of the SDK for 
JavaScript). The latter allows third-party providers to access Facebook's so-called 
"social graph". This comprises all the user data stored on the Facebook servers as well 


[...] 

https://developers.facebook.com/docs/facebook-loqin/overview/ . [...], cf. “Cross-platform login: Facebook Login 
is available on the most popular platforms for mobile and desktop apps. Users who create accounts on a platform 
via Facebook can also quickly and easily log into their app on another platform. Individuals always have the 
same user ID anywhere, ensuring a seamless, cross-platform app experience. Facebook Login is available for 
iOS, Android, Web and Windows Phone, for desktop apps and for Smart-TVs, Internet of Things objects and 
similar devices." 

https://developers.facebook.com/docs/facebook-loain/overview/ , [...] 

See under https://developers.facebook.com/docs/facebook-loain/overview/ , [...]: “Social Many highly retentive 
apps let people connect with their friends in order to enable shared in-app experiences. Facebook Login lets 
you know which of your app's users are also friends on Facebook so you can build value by connecting people 
together." 

See under https://developers.facebook.com/docs/facebook-loain/overview/ , [...]: “Personalizedexperiences are 
more engaging and lead to higher retention. Facebook Login lets you access information which would be 
complex or arduous to collect via your own registration form., for instance what users have marked with “Like" 
in relation to birthdays, hometowns, current places of residence or careers. Even just importing someone's 
profile picture imported from Facebook gives them a stronger sense of connection with your app.” 
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as their relationships and interactions. Third-party providers can include data from the 
social graph in their web service or app, such as "Likes" or ratings. The third party may 
also write data into the social graph. This occurs in particular when users perform 
"social actions" with the third-party provider, such as sharing, commenting or - for 
instance in the case of social games - posting certain actions for Facebook friends. 

816 Similar to social plugins, by integrating the Facebook Login, Facebook receives 
information from third-party websites/apps about the websites/apps Facebook users 
have registered with and users’ interaction with each website/app. It also receives 
browser and device-related information. As such, it is just as unnecessary for the user 
to activate the Facebook Login to initiate a data flow as it is for the social plugins. For 
a start, the volume of data that Facebook currently receives is the same as for social 
plugins. According to Facebook, the company also receives the login information which 
users enter directly and manually - without using the Facebook Login - on the website 
of the provider who has the Facebook Login embedded. 

817 The provision of a convenient login functionality for Facebook users, as with the use of 
social plugins, as shown above, (para. 703) does not require any data flow to Facebook 
about the use of the website or even the users’ registration data unless the user clicks 
the button. Only when the user clicks the button does a limited data record need to be 
sent to Facebook for the login data to be transmitted to the website. The integration of 
a Facebook Login does not imply the use of measurement and analytics products within 
Facebook Analytics or the use of advertisements on Facebook either. There is hence 
no reason to assume a data flow not controlled by the user is necessary for the 
functionalities of the Facebook Login or Account Kit. 

818 Also the other social networking purposes mentioned in the Data Policy and the various 
referenced documents for which this data may be used do not indicate the extent to 
which additional data collection is required for an unlimited number of websites and 
apps via the Facebook Login and Account Kit and why this cannot already be achieved 
by the extensive data processing on Facebook.com itself. The same applies to security 
and research purposes. In this respect, reference is once again made to the statement 
on Facebook’s own suite of services (see above para. 750ff.). 

Pixel and SDK-based measurement and analytics services 

819 In relation to the measurement and analytics services offered on the basis of the 
Facebook pixel and SDKs, the extensive data processing that takes place involving the 
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assignment of the data collected back to the respective Facebook user account is not 
necessary either for the pursuit of legitimate interests. 

820 For a start, as explained above, the pixel is used to send the data record of the “http 
header” collected during the integration of each interface to Facebook. When the 
website is accessed, a standard web protocol is created by default that includes IP 
addresses, information about the web browser, page location, document, referrer (the 
web page from which the user has accessed the current website), and the person using 
the website. Facebook records the “pixel-specific data” via the pixel, including the pixel 
ID and the Facebook cookie once the pixel-base code is implemented. Facebook also 
receives "click data" for buttons ("button-click data") by default, namely any buttons 
clicked by site visitors, the labels of those buttons and any pages visited as a result of 
the button clicks.®®^ 

821 In addition, the website operator can configure certain user actions ("Events") regarding 
the use of the third-party website or app. In this case, Facebook receives additional 
information about user behaviour on third-party websites and apps.®®"^ The pre¬ 
configured fifteen "Standard Events" include information about a purchase made on 
the website, a registration, the placing of goods in the shopping cart or a search query 
made by the user.®®® Depending on the website operator's wishes, further "event types" 
can be configured in addition to these standard events, for instance information on 
whether the user has scrolled down to the end of a page or how many articles have 
been read in a session.®®® As soon as a user takes corresponding action, this is 
recorded by Facebook and is assigned to the Facebook user account via identifiers. 
Facebook then provides the website operator with aggregated analyses of its target 
group.®®^ 

822 If - as with mobile apps - the analytics functions are implemented via the SDK, similar 
data is captured by Facebook. This includes the Facebook app ID, the mobile 
advertising ID and other metadata such as the device-related ID, the SDK version, app 
information, IP address and other device-related information.®®® By integrating the SDK, 
certain event types are automatically logged unless the app operator has deactivated 
this setting. These preset events (“Automatically Logged Events”) include "App Install" 


https://de-de.facebook.com/business/learn/facebook-create-ad-app-install-enqaqement , [...] 

69 ^ [...] 

999 https://de-de.facebook.com/business/heip/402791146561655?heipref=faq content : standard events: Add to 
cart, Add Payment info, Add To Wishiist, Compiete Registration, Contact, Customize Product, Donate, Find 
Location, initiate Checkout, Lead, Purchase, Scheduie, Search, Start Thai, Submit Appiication. 

996 https://deveiopers.facebook.com/docs/facebook-pixel/advanced , r...1 

997 See https://de-de.facebook.com/business/heip/898185560232180?heipref=faq content , [...] 
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(data about the first time a user activates an app), "App Launch” (data about the launch 
of an app) and "In-App-Purchase" (data about the purchase of a product via the app).®^^ 
In addition to these preset events, the app operator can also configure additional app 
"Event" types, so-called “Explicit Events”. Here, users can choose from a wide range 
of event types: These events can be data about an app being launched, payment data 
being added, a level being reached (e.g. in an online game), goods being placed in the 
shopping cart or added to a wish list, a registration or tutorial being completed, a 
purchase being started or completed, a rating being given, a product being searched 
for, credits being issued, a success being achieved or a content being displayed. 
The App Operators can add the above-mentioned Events in order to receive analytics 
data about user actions within their app or website. 

823 This extremely extensive data collection, and in particular the assignment of data to 
Facebook user accounts, is for the most part not necessary for Facebook's own 
purposes and interests. 

824 In this respect, Facebook has argued in the present proceedings that [...].^°^ 

j- j702|' ] 703 j- j 704 

825 The need for narrow interpretation of the term also suggests the data collection and 
assignment to the respective Facebook user account are not necessary as otherwise 
the conclusion could be drawn that all data processing from all sources would be 
necessary for the personalisation of ads. The argument that the data processing 
imposed is necessary in order to effectively display personalised ads [...],^°® cannot be 
used as a generalisation to explain why data processing is necessary. The fact that 
Facebook makes use of data collected from Facebook partners for personalised 
advertising conditional on users' consent mitigates against this. It is not clear why the 
collection of data and assignment to Facebook user accounts should nevertheless be 
necessary for the personalisation of ads, even if the respective users do not consent 
to the use of the data for this purpose. The high reach that Facebook has due to its 
user base and the analysis possibilities that exist based on the use of the social network 
alone are a sufficient basis for displaying targeted advertising and measuring the 


https://developers.facebook.com/docs/app-events/automatic-event-collection-detail , [...] 

https://deveiopers.facebook.com/docs/app-events/best-practices with numerous exampies of configurabie apps 
for the e-commerce, retail, travel and gaming industries, [...] 
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success of advertising and are in fact seen as one of the main attractions of Facebook's 
advertising network/°® 

826 Insofar as measurement and analytics services are offered independently of paid 
advertising, the collection of data on third-party websites and assignment to Facebook 
user accounts as stipulated in the Terms of Service are not necessary either. In order 
to provide analytics services, data on user behaviour must of course be collected and 
evaluated on the websites and apps to be analysed. It is not necessary for the provision 
of any such service to give access to the entire database on the social network’s users 
with which the data are collected and combined. In fact, personal data are not even 
needed for the reports and statistics produced and provided by measurement and 
analytics services. Even the market leader Google Analytics offers website owners the 
possibility of anonymising the IP addresses of its users. In this case, only an 
abbreviated version of the user's IP address is transmitted to Google Analytics, which 
does not enable Google Analytics to identify individual users. 

827 Moreover, in the case of measurement and analytics services, the required data largely 
depend on the individual needs of the users of these services, so that such analytics 
services are ultimately subject to consent to effective processing on behalf of the 
controller, in which only the website or app as the data controller can determine in detail 
the extent, type and intended use of the data by the provider. Here, too, reference is 
made to Google Analytics, which, following consultation with the data protection 
authorities, can only offer the service in the form of processing on behalf of the 
controller and in the context of which anonymisation can be arranged. 

828 Processing on behalf of the controller has not been effectively agreed in the case of 
Facebook. This cannot be replaced by a legitimate interest in the provision of analytics 
services, which is intended to require virtually unlimited collection and combination of 
data with other data from all other Facebook-owned services. 

829 The other social networking purposes listed in the Data Policy and the various 
referenced documents for which this data may be used, do not indicate the extent to 
which additional data processing is necessary for an unlimited number of websites and 
apps via the Facebook pixel or SDKs and why this cannot be achieved with the 
extensive data processing on Facebook.com itself. The same applies to security and 


706 [...] 

707 see https://support.qooqle.com/analvtics/answer/27630527hken; [...] 

708 https://www.lfd.niedersachsen.de/themen/internet/aooale analvtics/aooale-analvtics-hinweise-fuer-website- 

betreiber-in-niedersachsen-98936.html (last accessed on 10 January 2019). 
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research purposes. In this respect, reference is once again made to the statement on 
Facebook’s own suite of services (see above para. 741 ff.). 

• Legitimate interests of third parties 

830 Also to be included in the balancing of interests are the legitimate interests of the 
advertisers, developers and websites integrating Facebook Business Tools and whose 
interests Facebook invokes, particularly in the legal bases published. Accordingly, 
Facebook also bases the provision of measurement, analytics and other corporate 
services on the “interest of advertisers, deveiopers and other partners to heip them 
gain insights about their customers and improve their businesses, vaiidate our pricing 
modeis and evaiuate the effectiveness of their oniine content and advertising in and 
outside of Facebook companies’ products”. 

831 Hence, as already indicated with regard to Facebook-owned services, the interests of 
third parties at least partially overlap with those of Facebook, so that the massive extent 
of data processing possible under the Terms of Service for private users through 
intensive web tracking via a vast number of websites and apps with comprehensive 
recording of user behaviour and the assignment to Facebook user accounts cannot be 
covered by the legitimate interests of third parties either. 

832 According to the investigations carried out by the Bundeskartellamt, however, this 
extent of data processing also runs counter to the interests of third parties in respect of 
Facebook Business Tools. This is because the tools do not allow them to fully control 
the extent of data processing and the level of data protection they impose on their own 
website visitors or app users when they use Facebook Business Tools. At the same 
time, however, the Terms of Service require the users of Facebook Business Tools to 
provide the legal basis for the disclosure and use of customer data. When using the 
pixel or SDKs, the website or app is required to display a stable and sufficiently visible 
notice providing a minimum amount of information about data processing.However, 
those using Facebook Business Tools can only determine the extent of data processing 
to a very limited degree. This applies both to the Facebook data collected via the 
interfaces and to the assignment of data to Facebook user accounts and the use of any 
such for Facebook’s business purposes. 

833 This means the users of social plugins and the Facebook Login cannot prevent data 
from flowing to Facebook even if visitors to the website do not press the buttons. The 
only exception is the “Like” button, for which the so-called “two-click solution” was 
developed by third-party providers, where either just an icon of the button is initially 


https://www.facebook.com/leaal/technoloav terms , [...] 




237 


displayed and a connection is not established with Facebook until the second click, or 
a hyperlink takes users to a separate page and only there is the “Like” button integrated. 
This is far less convenient for visitors and Facebook users. There is no alternative 
solution available for other social plugins. 

834 With regard to the use of the Facebook pixel and SDKs for measurement and analytics 
purposes, third parties have a particular interest in function designs that are permitted 
under data protection law and in the option, for example, as part of effective processing 
on behalf of the controller or at least by concluding individual agreements as joint 
controllers pursuant to Article 26 para. 1 sentence 2 GDPR, of being able to (co- 
jdetermine the extent of data processing themselves. 

• Interests and rights of users 

835 Finally, the interests and rights of users must be taken into account. In this respect, 
users’ interest in and right to the protection of informational self-determination and their 
privacy are also paramount here. All other relevant legitimate interests of users must 
also be taken into account. Reference is made to the statement on Facebook-owned 
services (para. 759ff.) above. 

ii. Balancing of interests with regard to the consequences for the affected 
users 

836 Based on the nature of the data and data processing, and Facebook’s reasonable 
expectation and position vis-a-vis users, the interests and rights of users with regard to 
their privacy and autonomy ultimately also outweigh Facebook’s interests in the 
processing of data collected from Facebook Business Tools that are already less 
important because they are not necessary. They also outweigh the interests of third 
parties insofar as they coincide with the interests of Facebook. 

• Type of data 

837 This initially applies to the data affected by the processing of data collected from 
Facebook Business Tools, which, like data from Facebook-owned services, also 
include sensitive data. 

838 This includes sensitive data because the data processing imposed also involves 
special categories of data, device-identifying data and location data. The extensive 
harvest of browser and device-related data makes it possible to identify users, ensuring 
they can be fully traced on the Internet, while the users concerned have virtually no 
control mechanisms. By integrating Facebook Business Tools, users are tracked 
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across all services and devices in addition to the Facebook-owned services, so that a 
significant amount of sensitive data is affected out of all the data collected and assigned 
via the identifying device-related information/^^ 

839 Through the mass integration of Facebook Business Tools and APIs such as social 
plugins, Facebook Login or the Facebook pixel, Facebook collects and processes 
special data categories. The flirting app "Tinder", for instance, offers a Facebook login 
and the homosexual partner exchange "Queer" (www.queer.de) has an integrated 
“Share” on Facebook button. Even political parties such as CDU, SPD, Linke and AfD 
and healthcare websites such as www.onmeda.de or www.netdoctor.de have 
integrated “Share” on Facebook buttons. 

840 Furthermore, data processing can include users’ purchasing behaviour, transaction 
data and, ultimately, on their financial resources. This enables Facebook, which has 
further information about users based on its existing data record, to create detailed 
profiles even for particularly sensitive user data. 

841 The protection of privacy and autonomy takes on a high priority in view of the special 
sensitivity of this data. 

• Type of data processing 

842 In addition, the type of data processing performed via Facebook Business Tools 
represents a serious invasion of data subjects’ privacy. 

843 The intensity of web tracking is completely disproportionate to the legitimate purposes 
pursued by Facebook because it involves detailed tracking of a significant proportion 
of users’ Internet behaviour. 

844 The total number of Facebook Business Tools embedded in Germany runs into the 
high millions. The Bundeskartellamt questioned Facebook about the integration of 
individual interfaces into the 100 most visited websites and apps. 

845 Facebook provided high integration numbers, pointing out that these may be incorrect 
due to referrer spoofing. Of the 100 most visited websites in Germany in spring 2018 
[...] had a “Like” button or a “Share” button, at least on their subpages and in many 
cases even on their homepage. Over [...] of the 100 most visited websites had an 
integrated Facebook pixel. 


cf. also the Court of First Instance Brussels, judgment handed down on 16 February 2018, p. 69, English 
translation, [...] (in relation to non-Facebook users): “Moreover, the extent of the violations in question is massive 
(...) the number of websites that contain Facebook social plugins amounts to several million, rendering them 
practically unavoidable. The information in question is frequently of a very sensitive nature, allowing, for 
example, health-related, religious, sexual and political preferences to be gauged. (...)” 
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846 Because it had been pointed out that the information might be incorrect, the 
Bundeskartellamt checked the respective homepage and some subpages of the most- 
visited websites for visible “Like”, “Share” and “Page” button interfaces. Despite the fact 
that not all subpages were fully browsed, approximately 75 percent of the pages turned 
out to have one of the above-mentioned interfaces embedded. Hence, most of the data 
provided by Facebook is accurate. On this basis, the Bundeskartellamt assumes that, 
of the 100 most frequently visited websites in Germany, around [...] have integrated at 
least one of the interfaces on their homepage or subpages. 

847 Another particularly problematic aspect, as with Facebook-owned services, is that the 
majority of the data is used for the purposes of personalisation and individualisation of 
the Facebook.com service and covers the displayed ads, - also by enabling active 
fingerprinting -and is used for the detailed profiling that takes place in this respect.^^^ 
This leads to a massive additional invasion of privacy, since profiling tracks the affected 
users via an immense number of websites and apps, and the captured data is 
combined both with the data from Facebook-owned services and with the Facebook 
user data.'^^'^ 

• Users’ reasonable expectations 

848 The processing of data collected from Facebook Business Tools imposed does not 
correspond to the reasonable expectations of the data subjects either based on their 
relationship with the controller, which are particularly emphasised in Recital 47 of the 
GDPR. Contrary to the view held by Facebook^^^, it cannot be assumed with regard to 
the Facebook Business Tools that Facebook.com users are aware that a large amount 
of data from their entire Internet usage behaviour is being assigned to their Facebook 
user account and used for other purposes. 

849 For users need not reasonably expect that when visiting websites or installing and 
opening an app with Facebook Business Tools embedded, Facebook will gain direct 
access to a large amount of user and device-related data flowing to Facebook that is 
assigned to their Facebook user account in order to use the data for the social 
network’s own purposes. 


See also German Data Protection Conference (Datenschutzkonferenz, DSK), Short Paper No. 3 on the 
processing of personal advertising, current as of 29 June 2017, accessible at httDs://datenschutz- 
hamburq.de/paqes/kurzpapiere-dsqvo/, p. 2: “More intrusive measures such as profiling rather suggest that the 
data subject’s interest in the exclusion of data processing is overriding”. 

See also Article 29 Data Protection Working Party, Guidelines on Automated individual decision-making and 
profiling for the purposes of Regulation 2016/679, p. 16; Article 29 Data Protection Working Party, Opinion 
06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, pp. 75- 
77. 

^15 [...] 
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850 Users cannot expect the data flow if only because it already occurs the first time they 
visit the website or open the app, where often users have no way of telling if the website 
has integrated an interface. Even after that, they can only tell this if they see a button 
as in the case of social plugins or the Facebook Login. However, the Facebook pixel is 
usually not visible to users. This also applies if it is made visible as a graph, because 
the average user will not be able to recognise the meaning of the graph. 

851 The specific design of the social plugins and the Facebook Login, which significantly 
influences the relationship with users and visitors, also creates the expectation that no 
direct connection, including any data flow, is established with Facebook unless the 
button is pressed. Thus, the buttons present a significant risk of being misleading. This 
applies, in particular, to the Facebook Login, where the registration data manually 
entered by users is recorded even when they do no press the button. Hence, this can 
already be regarded as data processing undertaken in bad faith. 

852 Furthermore, when the Login button is pressed, users must above all expect data to 
flow from Facebook to the website or app that they are about to log into using their 
Facebook data. Only after the button has been pressed can a data flow from the 
website or app to Facebook also be expected for the transfer of login data, requiring 
assignment to the Facebook user account. Even if the Facebook Login is linked to other 
social plugins and the Graph API, users will only expect data to flow to Facebook if the 
corresponding “social actions” are triggered on the website or in the app. 

853 In terms of the integration of the Facebook pixel and SDKs, when visiting a third-party 
website or app, users need not reasonably expect their usage behaviour to be tracked 
online and assigned to their Facebook account to this extent for all of the social 
networking purposes pursued by Facebook involving comprehensive data collection. 
Nor can this be assumed to be part of the relationship between Facebook and its users 
given that the social network is financed by advertising. The Bundeskartellamt is also 
of the opinion that users must generally expect their interactions with advertising on 
Facebook to be tracked and used for advertising products when using an advertising- 
funded service. However, this does not automatically refer to behaviour off 
Facebook.com or to actions that are not carried out at the time the advertising 
displayed. Nor does the expectation include the data being assigned to Facebook user 
accounts for all social networking purposes. 

854 Insofar as the Facebook pixel and SDKs are used without reference to an 
advertisement for measurement and analytics services, there is no relationship at all 


Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Article 7 of Directive 95/46/EC, p. 56; [...] 
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between Facebook.com and users that would justify the expectation of extensive data 
processing and assignment to Facebook user accounts or indeed any processing of 
personal data at all. 

855 Users should not expect data records obtained via the Facebook pixel to be assigned 
to Facebook user accounts by transferring a hashed data set - for instance as part of 
advanced matching. Based on its own description of the Facebook pixel, Facebook 
uses this option even if no cookie has been set. If no cookies have been set, any such 
data collection and user tracking takes place contrary to the expectations of Facebook 
users who have blocked cookies and thus objected to web tracking. The same applies 
to the comprehensive browser and device-related information that allows users to be 
tracked and identified without cookies. 

856 Even if users have deselected “Ad Tracking” for personalised advertising in the settings 
of their mobile device, nothing else can apply. In this case, users can assume that the 
advertising ID for measurement and analytics services aimed at enhancing the 
efficiency of personalised advertising, will no longer be used. Users cannot reasonably 
expect Facebook to continue collecting the advertising ID throughout, merely adding 
the information that users have disabled ad tracking. 

857 After all, the millions of times Facebook Business Tools are integrated on German 
websites also exceeds users’ reasonable expectations regarding the amount of web 
tracking that generally takes place on the Internet. It is reasonable to assume that the 
average user can expect Internet use to involve a certain amount of web tracking. In 
the opinion of the Bundeskartellamt, however, it exceeds expectations that a single visit 
to the social network Facebook.com, setting cookies or collecting the advertising ID 
and browser and device-related data that takes place in the process will actually result 
in the user being tracked by Facebook on millions of other third-party websites or apps 
in Germany alone and the user data on Facebook being combined with an ID used. 

• Facebook’s position vis-a-vis users 

858 Finally, Facebook's position vis-a-vis users means that the need for protection against 
the massive invasion of privacy associated with the processing of data collected from 
Facebook Business Tools is particularly high and must take precedence over 
Facebook's interests. As a multinational company with a dominant position in the 
market, Facebook has the relevant bargaining power to impose extensive data 
processing unilaterally on users via Facebook Business Tools. The need for protection 
is also evident, as already mentioned above in relation to Facebook-owned services, 
in view of Facebook's monopoly-like position and the scope of data processing, which 
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Facebook also reserves in its Data Policy with regard to the Facebook Business Tools. 
Reference is made to the information above (para. 785). 

859 In addition, Facebook's dominant position in the market means that data processing 
from a variety of sources cannot be prevented simply by switching social networks. 
This is because market dominance means that there are not sufficient alternatives 
available to switch to another provider. Users would therefore have to refrain from using 
other Facebook-owned services as well as from visiting websites if they did not want to 
add any additional data to their extensive Facebook database. 

860 This applies only to the extent to which users are aware that this level of data 
processing is implemented via Facebook Business Tools. If users were to try to prevent 
this, it would mean that Facebook users would practically have to stop using the 
internet, given the unpredictable millions of times the tools have been integrated into 
German websites. 

iii. Lack of protective measures 

861 In connection with the processing of data collected from Facebook Business Tools, 
contrary to Facebook's claim^^^, there are currently no protective measures in place to 
achieve a fair balance of interests. The Bundeskartellamt also points out with regard to 
Facebook Business Tools that no such case exists which is unclear with regard to the 
question of balance. On the contrary, on the basis of the key factors outlined above, 
there is a gross imbalance between the extent of data processing at the expense of 
users' self-determination and the largely non-legitimate interests of Facebook. The 
interest third parties have in controlling data processing in relation to visitors to their 
websites and apps also needs to be taken into account. 

862 It is therefore also important to note, with regard to data processing via Facebook 
Business Tools, that no adequate protective measures are currently in place. To what 
extent the "clear history functionality" announced [...] by Facebook is capable of 
balancing interests, including the interests of third parties, is very questionable and can 
remain open here as it has not yet been implemented. 

863 From the Bundeskartellamt's point of view, the horizontal provisions are not being 
complied with either in relation to Facebook Business Tools. This applies first of all to 
the transparency obligation regulated in Article 5 (1 a) GDPR with regard to the 
processing of data collected from Facebook Business Tools, which, as described 
above, also exists with regard to the extent to which personal data are processed and 
will continue to be processed in the future. Facebook points out in the Data Policy under 

[...] 
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the heading "Information from partners" that data is processed via Facebook Business 
Tools and explicitly mentions the “Like” button and Facebook Login. The Cookies Policy 
also refers to the use of cookies in connection with the Facebook Business Tools, 
specifically the social plugins. However, this only indirectly indicates that data 
processing takes place even when these buttons are not pressed (whether or not users 
have a Facebook account or are logged in). 

864 What is problematic in this context is the unclear assignment of data processing to the 
legal bases invoked. Facebook makes some of the processing of data collected from 
Facebook Business Tools dependent on consent whereas other elements of data 
processing are attributed both to Article 6(1 b) GDPR and Article 6(1 f) GDPR. This also 
only applies if Facebook perceives itself as the data controller, meaning that it remains 
unclear to users what rights they have. In particular, there is little point in advising users 
that they can object to their data being processed if Facebook then argues that data 
processing is either necessary for contractual performance or that Facebook is not the 
data controller. 

865 Users do not have any other control mechanisms to prevent the collection and 
combination of data from Facebook Business Tools. In particular, the possibility users 
have of using the relevant browser settings to prevent Facebook cookies from being 
set and thus data from being assigned to their Facebook user account cannot be 
deemed an effective control mechanism. This is already true because cookies are only 
assigned to websites, but not to mobile apps where the data is assigned via the 
advertising ID. This type of assignment cannot be effectively prevented as outlined 
above (para. 656ff.), since the advertising ID is collected anyway and users can be 
identified even if the advertising ID is reset. 

866 Moreover, a browser setting that can only block the Facebook cookies for all possible 
uses would also eliminate or at least impair users' ability to use the social plugins. As 
outlined above, Facebook points this out in very general terms in the last sentence of 
its Cookies Policy: “Certain parts of the Facebook Products may not work properly if 
you have disabled browser cookie use”.Users would deprive themselves of the "Like" 
and "Share" functions of the interface, which, according to Facebook, does not work 
unless it can be assigned unequivocally to Facebook user accounts via cookies. From 
the users' point of view, it is not apparent either that although disabling cookies 
prevents the assignment to Facebook user accounts via the user ID, it does not prevent 
the data flow as such, which could also be assigned in other ways - for instance through 
advanced matching or device fingerprinting. 
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867 There are currently no privacy settings either - as Facebook itself indicates - that enable 
users to control the collection of data on third-party websites via Facebook Business 
Tools or the combination of data with Facebook user accounts/^® The reference to the 
possibility users have to opt out of the use of this data for the purposes of personalised 
advertising^^®, is not sufficient here. As explained above, this refers only to the use of 
data for personalised advertising and is limited to displaying advertising to user. It does 
not exclude the collection, combining or use of the data. 

868 The newly introduced possibility for third-party websites to delay data collection by 
Facebook until the third-party provider has obtained the users' consent,^®® does not 
represent a sufficient control mechanism for users. Facebook itself is responsible for 
the data processing. Users' consent vis-a-vis third-party providers cannot justify data 
processing by Facebook. Third parties do not have sufficient insight into the data 
processing procedures that Facebook performs in relation to Facebook Business 
Tools. Since the data flows directly to the Facebook servers, third-party providers are 
unable to identify the amount of data collected or how the data is combined and used. 
There is no point in referring the third-party providers obtaining consent unless effective 
data processing on behalf of the controller is involved. However, this is not the case 
here (see above para. 617ff.). 

869 There is no evidence that any other measures have been taken such as technical or 
organisational measures like separating Facebook Analytics from the operation of the 
social network. 

(c) Outcome of the balancing of interests 

870 In the final analysis, there is a gross imbalance between the interests of Facebook, only 
some of which are legitimate, and the protection of users’ fundamental rights when 
processing data from Facebook-owned services and Facebook Business Tools, 
especially when a holistic view is taken. The interests of third parties are not taken into 
account when data is processed from Facebook Business Tools either. As a result. 
Article 6(1 f) GDPR cannot be invoked as a legal basis for the processing of data 
collected from Facebook-owned services or Facebook Business Tools. 


[...] 

719 [...] 

720 [...] 
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4. Infringement as a manifestation of market power 

871 These data processing conditions are also abusive within the meaning of Section 19(1) 
GWB. In the present case, their agreement and practice are the result of Facebook's 
special market power, which gives rise to the anti-competitive effects (see (a) above). 
At the same time, it is clear that they are to be regarded as abusive when taking into 
account all interests and the objective of the Act on Restraints of Competition, which is 
aimed at promoting free competition. Even if a more far-reaching balancing of interests 
was required under antitrust law, the conclusion would be the same as an assessment 
under the relevant provisions of data protection law (see b.). 

a. “Manifestation of market power” and causality 

872 According to the review concept of the case law of the Federal Court of Justice on the 
Supplementary Pensions Agency for Federal and Lander Employees {VBL) the 
prerequisite that the violation of legal adequacy provisions "must take place as a 
manifestation market power or a great superiority of power" is a suf/y'c/enf condition for 
linking an objective accusation of abuse under antitrust law to the violation of antitrust 
law norms; it can be inferred from the wording "in particular" in the relevant Federal 
Court of Justice rulings that the Federal Court of Justice has deliberately refrained from 
making the "manifestation" clause a necessary prerequisite for any allegation of abuse 
under antitrust law.^^^ If the prerequisite is met, it provides sufficient evidence to make 
the infringement of non-antitrust regulations simultaneously subject to antitrust law by 
the required reference to market power. At the same time, however, this feature does 
not constitute a more far-reaching requirement than the wording of Section 19(1) GWB 
which refers to the "abuse" of a dominant market position. 

873 Contrary to Facebook's argument, the required link with market power is therefore not 
to be construed within the meaning of a strict causality of market power, requiring proof 
that data processing conditions could be formulated in such a way precisely and solely 
because of market power.'^^^ For the "abuse" of a dominant market position, according 
to general rules, it is sufficient for there to be “normative causality" between market 
dominance and the conduct.'^^^ It is sufficient if the conduct proves to be anti- 


Federal Court of Justice, decision of 6 November 2013 - KZR 58/11, VBL Gegenwert /; Federal Court of Justice, 
judgment of 24 January 2017 - KZR 47/14 para. 35 (juris). 

^22 [...] 

Fuchs in Immenga/Mestmacker, GWB, 5th edition 2014, Section 19 para. 82b; further details on the prohibition 
to demand unjustified benefits from suppliers (“Anzapfverbot”) Section 19 (1), (2) no. 5 GWB: not even normative 
causality required according to Federal Court of Justice, decision of 23 January 2018, KVR 3/17, WuW 2018, 
209 para. 81,83ff. - Wedding discounts. 
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competitive as a result of market dominance, which does not require strict causality but 
rather a causality in relation to the outcome.”'* 

874 In the VBL Gegenwert //judgment, the Federal Court of Justice indicated in its guiding 
principle that inappropriate terms and conditions which make it more difficult to 
terminate a long-term contractual relationship with a norm addressee of Section 19(1) 
GWB regularly constitute abuse of market power.^^^ This clearly refers to the potential 
effect of the clause in connection with market power. The Federal Court of Justice did 
not consider it necessary to examine whether competitors are using a similar clause. 
In view of the fact that VBL had a dominant position on the relevant market for 
supplementary public service pensions with market share of 37 percent, taking into 
account that the Federal Government and most of the Lander are involved by way of a 
collective agreement, VBL would still have been considered to have a dominant 
position in the market even though it has competitors.^^® Instead, the Federal Court of 
Justice has ruled that it is sufficient for a condition which makes it more difficult to 
terminate a long-term relationship with a dominant undertaking to involve the risk of 
further strengthening market power by creating an additional barrier to market entry. 
Accordingly, it is not necessary in the present case to review the clauses on the basis 
of a historical, geographic or cross-service comparison.^^^ 

875 A "normative-causal" connection in this respect between the norm addressee status 
and the infringement and the consequences of this infringement is therefore sufficient 
pursuant to the above-mentioned principles. Any such connection is to the detriment of 
private users considering there is a legal connection in the form of normative causality 
between antitrust law and data protection assessments (see (1) below). Unlawful data 
processing also has the potential effect of obstructing competitors through the risk of 
transferring market power (see (2). 

(1) Normative-causal connection with infringement of data protection law 

876 First of all, there is a normative-causal connection in the vertical relationship with 
private users between the existence of a dominant position in the market and the 
violation of the relevant assessments under data protection law. In this particular case, 
the infringement of data protection rules exists given that the restriction of private users’ 


OLG Dusseldorf, judgment of 12 July 2017, “Kabeleinspeiseentgelte", para. 131 (iuris); Frankfurt Higher 
Regional Court, Getting in Loewenheim/Meessen/Riesenkampf, voi. 2, GWB, Section 19, para. 61; Bechthoid, 
GWB, 8th edition. Section 19, para. 5; Wiedemann, Handbuch des Karteiirechts, 3rd edition. Section 23, para. 
55. 

Federal Court of Justice, decision of 24 January 2017, “VBL-Gegenwert ll“, file ref. KZR 47/14 (juris). 

Federai Court of Justice, decision of 24 January 2017, “VBL-Gegenwert ll“, file ref. KZR 47/14 (juris). 
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right to self-determination is clearly linked to Facebook's dominant position in the 
market. 

877 For a start, this applies to the lack of voluntary consent. Recital 43 of the GDPR says 
that in order to ensure that consent is freely given, consent should not provide a valid 
legal ground for the processing of personal data in a specific case where there is a 
“clear imbalance” between the data subject and the controller. Furthermore, according 
to Recitals 42 and 43 of the GDPR, it should only be presumed that data subjects have 
given their consent voluntarily if they have a genuine or free choice or are able to refuse 
or withdraw consent without detriment. In any event, the very fact that the company 
has a dominant position in the market means consent is not given voluntarily.^^® 

878 Furthermore, the market-dominating position also plays a role in the context of the legal 
bases governing data protection set forth in Article 6(1 b) GDPR (in the context of the 
necessity for performance of the contract) and Article 6(1 f) GDPR (in the context of the 
balancing of interests). It means that Article 6(1 b) GDPR can be invoked in view of the 
monopolistic position and the fact that a dominant undertaking can dictate data 
processing conditions (cf. above para. 677). In addition, the Art. 29 Data Protection 
Working Party emphasises, as indicated above, that the dominant position of the data 
controller is a key factor when balancing interests in Article 6(1 f) GDPR (see above 
para. 730).^^® 

879 The violation of data protection requirements established in this case is a manifestation 
of Facebook's market power. Data protection law considers corporate circumstances 
such as market dominance, the concrete purpose and the amount of data processed 
in its justifications. This means that companies behaving in a similar way that do not 
have a dominant position in the market would need to be assessed differently. 

880 Therefore, there would be a correlation with market power in this particular case even 
if this was understood within the meaning of strict causality. The violation of data 
protection law in this case was only possible in the first place because other market 
participants did not have a chance to behave in a similar way. Just because other 
Internet companies such as Yahoo, Bing Oracle or Google collect data via interfaces^®® 
does not mean the same conduct by Facebook is permissible under data protection 
law. 


[...] 

^29 Article 29 Data Protection Working Party, Opinion 06/2014 on the legitimate interests of the data controller 
pursuant to Artlole 7 of Directive 95/46/EC, p. 51,71; [...] 

^30 [...] 
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881 In this respect, the concerns expressed by the DICE Consult expert in the report "An 
Economic Analysis of the Role of Data Collection in Social Networks”^^^ are not 
relevant. One of the assumptions voiced in the expert opinion is that if Facebook were 
to restrict the processing of "off-Facebook" data, it would be forced to compete less 
effectively with its competitors by offering less innovative and poorer-quality services, 
especially vis-a-vis Google. One of the reasons for this is that Facebook is subject to 
discriminatory data protection requirements with regard to market dominance. In 
addition, users would be doing themselves a disservice if they refused to consent to 
data processing that certainly offers benefits. 

882 To assume that data protection law does not take the individual circumstances of the 
company, including market dominance, into account and that these aspects are only 
introduced via antitrust law, would be to disregard the legal bases and standards of 
data protection as a whole, as well as the method of examining abusive business terms 
developed by the Federal Court of Justice. It obviously assumes that the company's 
market position does not constitute an aspect of the assessment of data protection 
standard that needs to be met. However, as stated above, this is incorrect. The data 
protection standard phrased in the GDPR may certainly appear debatable from the 
economic expert's perspective. However, this does not alter the fact that this is the 
applicable standard for defining the right of informational self-determination enshrined 
in the constitution, which accepts that economic advantages may be restricted within 
the framework of balancing of interests. 

883 It seems reasonable and appropriate to take a company's market position into 
consideration under data protection law. This not only has implications for the extent 
and consequences of data collection. Above all, it plays a key role in deciding whether 
users have options available and can thus decide for themselves what level of data 
protection they want, or whether they only accept data processing because they would 
otherwise be unable to avail themselves of a particular service. The fact that in the 
latter case users may not have a free choice and the ability to determine how data is 
processed is also indicated by the studies in this case. According to the user survey, 
75% of respondents consider the handling of data to be an important factor in their 
choice of social network (see above, para. 427). If, on account of the company's market 
position, users have no alternative but to consent to their data being processed, they 
are unlikely to read the data policy as they have to give their consent anyway. Due to 
the lack of alternatives and the strong lock-in effects (para. 460ff.) users are unlikely to 
be able to switch to another provider even if they later become dissatisfied with how 


^31 [...] 
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their data are being used. This means users have little or no possibility of switching to 
alternative providers in order to avoid the dominant undertaking’s conduct. 

884 Finally, the present assessment of data protection law and the determination of 
Facebook as a company that has a dominant position in the market says nothing about 
whether and to what extent other market-dominating companies may be violating data 
protection laws on their relevant markets with the individual data processing they carry 
out. If Facebook claims that other companies also exchange data within their groups^^^ 
or combine data from third-party sources with their groups’ own data^^"^, this cannot be 
used as a benchmark for assessing the impropriety of Facebook’s conduct: Contrary 
to Facebook's view, the behaviour of third parties, which may also be violating data 
protection law cannot be conventionalised to become the “established industrial 
standard"^^®, as this means the wrong-doing of others would become the criterion that 
condemns the norm addressee. This could lead to the paradoxical outcome that 
smaller competitors - similar to umbrella effects in cartel agreements'^® - might be 
tempted to act in violation of data protection law under the "umbrella" of the dominant 
undertaking and the dominant undertaking could then refer to competitors’ conduct to 
justify its own behaviour. 

(2) Causality with regard to impeding effects on competitors 

885 In addition, there is a causal relationship between the unlawful data processing 
conditions and market dominance with regard to the actual and potential impediment 
effects to the detriment of competitors. 

886 With Internet platforms that are financed by advertising, such as Facebook, the 
incentive is very high to exploit the data processing scope in order to ensure the market 
success of advertising. Due to unlawful data processing conditions that give access to 
the user data of potential advertising customers - such as social plugins, Facebook 
Login and the interface for measurement and analytics products - the risk of transferring 
market power is also particularly virulent. The information gained from this allows 
Facebook to make attractive offers to third-party operators in the form of targeted 
advertising tailored specifically to their users. 

887 As outlined in the foregoing, this also applies to the processing of data collected from 
Facebook-owned services, in particular from WhatsApp and Instagram. The de facto 

Langen/Bunte/Nothdurft, Section 19GWB, para. 195 
^33 [...] 

^34 [...] 

735 [...] 

736 For the phenomenon of umbrella effects, see Inderst et al., "Umbrella Effects", WuW 2014, p.1043 ff. 
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integration of services through interrelated functionalities and de facto shared user 
accounts that data processing can bring involves the risk of transferring market power 
to markets on which these services operate. WhatsApp, for instance, already has a 
strong position in the market for messenger services, which could expand further if the 
service is further integrated with Facebook. It is important in this respect that WhatsApp 
and Instagram are also characterised by direct network effects and that data 
processing for the purpose of consistent personalisation with the possibility of 
standardising lists of friends and contacts makes it more difficult for users to migrate to 
other services, parts of which are competing with Facebook. In this context, the 
competition between Instagram and Snapchat for photo services is worth noting. 
Instagram has a major advantage by standardising the "product experience" with 
Facebook.com, making it more difficult for users to switch providers. 

888 Moreover, inappropriate data processing also leads to an increase in barriers to market 
entry for potential competitors in the market for social networks. By introducing the 
criterion of market dominance regarding access to data relevant for competition in 
Section 18 (3a) no. 4 GWB, the legislator expressly acknowledged that access to data 
relevant for competition can be of paramount importance for market entry and market 
success. Since the collection and processing of data is essential to the business model 
of social networks, they are always keen to collect as many data as possible. This is 
because detailed knowledge about users enables them to target the kind of advertising 
Facebook wants to offer. Access to data is therefore an important market dominance 
factor when assessing a company’s position in the market. The competitive edge 
Facebook already has owing to its excellent access to data relevant for competition will 
be further expanded by inappropriate and thus unlawful processing of data from other 
sources assigned to Facebook user accounts, thereby further raising the existing 
barriers to market entry as a result of direct network effects. In this respect, too, there 
is a direct correlation between the actual effect of the Terms of Service and market 
power.^^^ Competitors who have lawfully handled the collection and processing of 
personal data in the past are therefore at a competitive disadvantage vis-a-vis 
Facebook.'^^® 


Weichert said this in "Vioiations of Data Protection Law as a Business Modei - the Case of Facebook” 
(DatenschutzverstoR ais Geschaftsmodeil - der Faii Facebook), DuD 2012, 716ff. iisting Facebook's data 
protection vioiations and claiming that acquisition of personal data which contravenes data protection law gives 
Facebook an inadmissible competitive edge over competitors who behave in a legally compliant manner. 

^38 [...] 
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b. Balancing of interests under antitrust law 

889 If terms of business violate data protection values as a result of market power, the 
comprehensive balancing of interests required within the framework of control of 
abusive practices, taking into account the objective of the German Competition Act, 
which is to promote free competition, does not have any independent significance (see 
(1) according to case law of the Federal Court of Justice in the VBL proceedings. 
Balancing interests under antitrust law as a precaution in this particular case also leads 
to the same outcome as the balancing of interests under data protection law (see (2) 
above). 

(1) Necessity according to case law 

890 The case law of the Federal Court of Justice in the proceedings VBL-Gegenwert II 
shows there is no need to balance interests under antitrust law as well. In this case, 
the Federal Court of Justice ruled that legislation on general terms and conditions had 
been breached by contractual conditions as a manifestation of market power and no 
further balancing of interests was carried out. From the point of view of the Decision 
Division, this is also consistent on the basis of the VBL assessment concept. 

891 This follows first of all from the consideration that if a company with a dominant position 
in the market has been found to infringe legal provisions, the balancing of interests 
cannot, for legal reasons, lead to the conclusion being drawn that the undertaking has 
an overriding interest in breaching antitrust law. If an infringement is the result of market 
power as outlined above, the abusiveness can no longer be called into question by a 
further balancing of interests. 

892 This ensues from the examination concept itself, which for the interpretation of the 
antitrust concept of the appropriateness of conditions relies on comparable concepts 
of appropriateness defined in other legal areas in similarly unbalanced negotiation 
situations such as legislation on general terms and conditions or data protection law. 
The appropriateness rules of other legal areas are themselves the result of a balancing 
of interests with regard to the necessary reconciliation of interests in the negotiation of 
terms and conditions. This becomes particularly clear in relation to the data protection 
assessments used here that are based, by and large, on a balancing of interests as 
per Article 6(1 f) GDPR for the justification of the data processing conditions, also taking 
into account the data controller’s dominant position in the market. 

893 The case law of the Federal Court of Justice in the Pechstein case concurs with this 
finding. In the proceedings, the Federal Court of Justice did indeed focus primarily on 
a balancing of interests which was also deemed necessary in the context of Section 
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19(1) GWB/^® This was preceded, however, by the fact that no objection could be 
raised against the arbitration clause to be examined in this case pursuant to the 
provisions set forth in the Code of Civil Procedure, which are also intended to prevent 
a party from being placed at a disadvantage/'^® The further balancing of interests under 
antitrust law carried out by the Federal Court of Justice, taking into account the 
constitutional rights of both parties, served only to clarify the question of whether the 
invalidity of the arbitration clause could result from the more far-reaching legal 
requirements that the norm addressees of Section 19 GWB have to fulfil beyond the 
general requirements (of the Code of Civil Procedure). The decision in the Pechstein 
case therefore does not prove it is necessary to balance interests in a case in which 
the norm addressee is already violating the regulations of the legal system that also 
apply to non-norm addressees. 

(2) Balancing interests simultaneously under antitrust law and data protection 
law 

894 In the present case, the balancing of interests under antitrust law to be carried out 
merely as a precautionary measure leads to the same outcome as an assessment 
under data protection law. This is because in view of the unbalanced negotiation 
position represented by data protection law, the assessment must be based on similar 
balancing factors, one of which is market dominance. 

895 This corresponds to the case law of the Federal Court of Justice on antitrust law in the 
Pechstein case. According to this, the fact that the user did not ask for individual 
contractual terms and conditions does not initially preclude a self-determined 
conclusion of a contract as a matter of principle, since the contractual agreement as a 
whole can represent a balancing of interests which also regularly involves relinquishing 
one's own positions. If, however, one of the contracting parties has such a dominant 
position that it can actually impose contractual provisions unilaterally, this means 
conditions are being dictated by the other contracting party. This applies in particular if 
a monopoly or quasi-monopoly exists. It is precisely this circumstance that requires the 
application of the general clauses of civil law such as Section 19 (1) GWB which must 
bring about a balance of interests while taking the parties’ constitutional rights into 
account.^"^^ 


^39 Federal Court of Justice, judgment cf 7 June 2016, KZR 6/15 - Pechstein, para. 48 (juris), 
loc. cit., para. 23 tc 39. 

Federal Court of Justice, judgment ef 7 June 2016, KZR 6/15 - Pechstein, para. 57 (juris). 
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896 The narrow interpretation of Article 6 (1 b) GDPR is based on the same idea. It cannot 
be up to the data controller alone to define what is necessary for the performance of a 
contract, since this would undermine the protection against third-party control and the 
need to weigh up interests. Also the balancing of interests required pursuant to Article 
6(1 f) GDPR is being consistently implemented, taking all the relevant organisations 
involved, the data subjects and third parties into account on the basis of principles 
governing data protection law. The relevant aspects are also of paramount importance 
when balancing interests solely under antitrust law. 

897 This applies first of all to the fact that the comprehensive collection and allocation of 
user data from Facebook-owned services and Facebook Business Tools and their use 
outlined above are unnecessary. It is certainly acknowledged that Facebook has an 
interest in processing data to improve its product and the commercial basis formed by 
personalised advertising. The processing of data is necessary in such "big data" 
business models. However, this does not mean, that scope of data processing can be 
freely determined by the company and is not subject to antitrust review. However, it 
must be ensured that the interests of the opposite market side are sufficiently taken 
into consideration if a provider is a dominant company that is not subject to sufficient 
competitive control. This means that the provider must not place any unnecessary 
burdens on the opposite market side. 

898 According to the data protection assessment, the extent to which a company that is 
dominant in the market can impose terms and conditions unilaterally must be taken into 
account as outlined above. The same applies to the balancing of interests under 
antitrust law. 

899 On the users’ side, the data protection standard of users’ "reasonable expectation" 
corresponds to the specific problem of market power in relation to the Terms of Service 
and in particular the data processing scope. This can be attributed to the very fact that 
users have no overview of the scope of the terms and conditions and the extent, 
significance and sources of data processing. The benchmark is therefore also 
meaningful for an assessment under antitrust law, taking the objective of promoting 
free competition into account. For the freedom of competition is aimed specifically at 
giving the opposite market side the opportunity to decide freely on the agreement of 
contractual terms. 

900 In addition, pursuant to the Pechstein case law, assessments with regard to 
constitutional rights have to be included in assessments of interests under competition 
law.^‘*2 According to this, it would also be conceptually possible in the present case, to 

Federal Court of Justice, judgment cf 7 June 2016, KZR 6/15 - Pechstein, para. 55 (juris). 
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determine the abuse directly by comprehensively balancing interests, taking the 
constitutional rights of the contracting parties into account with regard to the exclusion 
of voluntary self-determination as a result of market dominance. In this respect, it needs 
to be considered, however, that the GDPR also makes a statutory decision on the 
balancing of fundamental rights, in particular in the form of justifications pursuant to 
Article 6(1) GDPR. It is basically assumed that this technical substantiation applies to 
the antitrust perspective in view of the conflicting positions regarding fundamental 
rights. In the present case, this also unifies the balancing framework. 

901 Essentially, therefore, reference can be made to the assessments under data 
protection law for the balancing of interests under antitrust law. From the point of view 
of the Bundeskartellamt, the essential aspect in balancing of antitrust interests is the 
significance of Facebook's dominant position on the market for social networks for 
continued use of the internet by users if they have to accept the above-mentioned data 
processing conditions in order to use of the social network in the first place. 

902 In addition, Facebook's market dominance means that unlimited data processing from 
a variety of sources cannot be prevented simply by switching social networks. Users 
would have to refrain from using a variety of services if they did not want to add any 
more data to their extensive Facebook database which lacks transparency. This would 
greatly reduce the choice of internet services for users. 

903 WhatsApp and Instagram, for example, are widely used services with a high user base, 
which in turn have direct network effects. As such, it is questionable whether users will 
be able to do without these services at all in view of the network effects and the market 
position achieved particularly by WhatsApp. Even if this were the case, it would 
represent a major and disproportionate limitation of general use of the internet if 
Facebook users were no longer able to avail themselves of all other Facebook services 
in order to prevent data collected by these services from being added to the already 
detailed user profile which Facebook has. What is more, over [...] of the monthly active 
Facebook.com users also use WhatsApp and in excess of [...] use Instagram.^"*^ All 
things considered, this means that Facebook.com users could only prevent their data 
from being collected outside the social network if they ceased using the internet to a 
large extent and stopped using widespread services such as WhatsApp. 

904 Corporate efficiency cannot be used as an argument from the antitrust perspective. It 
is true that a common strategy within a group to leverage potential internal synergies 
and to develop efficient database structures can represent legitimate interests. 
However, a general group privilege that would rule out any such group efficiency by 

[...] 
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consistent abuse pursuant to Section 19(1) GWB does not exist in antitrust law either^"^"^ 
- for instance in cases where the provision of a service is conditional on consent to 
data processing. Contrary to Facebook’s opinion, no such group privilege can be 
derived from Section 36 (2) GWB. The protection interests of users are predominant 
here particularly in view of the fact that it is not apparent why the comprehensive 
combination of data is necessary. 

905 With the social plugins, Facebook Login and the measurement and analytics tools for 
third-party providers, the aim of the German Competition Act to promote freedom of 
competition implies that users have an overriding interest in controlling their data from 
these sources. Users would basically have to stop using the internet given the millions 
of integrated social plugins, Facebook Logins and other interfaces that exist in 
Germany which users are unaware of before they call up the website and which are 
not visible.in many cases. When using third-party services, users are thus forced to 
hand over data beyond the social network and Facebook-owned services which is then 
assigned to their Facebook user account. This constitutes an abusive enforcement of 
further access to data collected from third-party services, also by antitrust standards. 

906 Finally, contrary to Facebook's view^"^^, the lack of an economic quantification of the 
abusive conduct based on a comparison between the resulting net consumer benefit 
and the harm to consumers in order to prove that the consumer benefit decreases as 
a result of the conduct at issue cannot be used as a justification. 

907 Facebook submitted an economic private opinion by Professor Evans^'^® to this end, 
which comes to the conclusion on the basis of rough calculations drawn up as an 
example that Facebook as a whole offers a net benefit to German consumers and that 
here is no evidence of harm to users. The expert opinion suggests the following 
approximate measurements [...] 

908 Apart from the fact that the expert opinion does not make any distinction between an 
examination of data from Facebook-owned services and Facebook Business Tools on 
the one hand and the data collected through use of the social network Facebook.com 
itself on the other, meaning that at best it relates indirectly to the subject matter of the 
proceedings, an economic quantification of abusive behaviour hardly seems 
possible.'^'^^ 


744 

745 

746 

747 


Cross-subsidisation of products within the group is, for instance, subject to abuse control, of. e.g. for European 
law Langen/Bunte, Europaisches Kartellrecht, 12th edition. Article 102 TFEU, para. 315 

[...] 

[...] 

[...] 
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909 Contrary to the premise of the expert opinion, it can be assumed that the conduct 
contested can also lead to potential user harm in economic terms. Even the collection 
of data itself can lead to behavioural changes among users, for instance, to avoid 
adverse reaction among friends or public bodies.^'^® In addition, the extensive transfer 
of Facebook users' personal data by the Facebook Group to Cambridge Analytica^'^^ 
and various smartphone manufacturers^^® shows that from the users’ perspective 
unwanted data flows even on Facebook do not merely pose risks in theory. 

910 Users might potentially suffer material (financial) harm if Facebook discloses data to 
third parties, whether intentionally or unintentionally, for instance, leading to identity 
theft, extortion or fraud. Users might also suffer non-material damage. The collection 
of data may reveal information which the user considers worthy of protection and which 
is not provided voluntarily such as income, location, diseases, political views or sexual 
orientation.'^^^ The potential for damage increases with the scope and quality of the 
data, if Facebook data from Facebook-owned services or Facebook Business Tools 
allow conclusions to be drawn about the history of sensitive websites accessed by 
users. Due to the particular depth of detail of the data, from the user's point of view this 
involves a data pool with particularly high damage potential. 

911 In this context, scientists point out that any negative external effects of data collection 
are to the detriment of users. While more extensive data collection offers the company 
collecting the data increased monetisation potential, users bear the bulk of the potential 
financial (and intangible) costs incurred. This creates a false incentive for the 
companies collecting the data, which harvest "too much" data from the consumer 
welfare point of view.^^^ 

912 Nonetheless, it is difficult to quantify the effects of the damage, since it is not clear 
whether, when and how potential material or, in particular, immaterial consumer 
damage will occur and which users will be affected. It is not possible to predict either 
what damage potential the data may have as a result of possibilities for combination or 


cf. Marthews, A., Tucker, C. (2017). Government Surveillance and Internet Search Behaviour. Accessible at 
http://dx.doi.orq/10.2139/ssrn.2412564 (last accessed on 10 January 2019). 

cf. New York Times of 4 April 2018, “Facebook Says Cambridge Analytica Harvested Data of Up to 87 Million 
users”, accessible at https://www.nvtimes.eom/2018/04/04/technoloqv/mark-zuckerberq-testifv- conqress.html 
(last accessed on 10 January 2019). 

cf. New York Times of 3 June 2018, “Facebook Gave Device Makers Deep Access to Data on users and 
Friends”, https://www.nvtimes.eom/interactive/2018/06/03/technoloqv/facebook-device-partners-users-friends- 

data.html (last accessed on 10 January 2019). 

cf. Jin, G., “Artificial Intelligence and Consumer Privacy” in: Agrawal A., Gans, J, Goldfarb, A. (publisher). The 
Economics of Artificial Intelligence: An Agenda, Chicago: University of Chicago Press, 2018, accessible at 
https://www.nber.orq/chapters/c14034.pdf (last accessed on 10 January 2019). 

cf. Jin, G., “Artificial Intelligence and Consumer Privacy” in: Agrawal A., Gans, J, Goldfarb, A. (publisher). The 
Economics of Artificial Intelligence: An Agenda, Chicago: University of Chicago Press, 2018, 
https://www.nber.orq/chapters/c14034.pdf (last accessed on 10 January 2019). 
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technical analysis that may not be available currently but could well be in the future/®^ 
This also concurs with the assessments of the Article 29 Data Protection Working Party, 
which refer to justification pursuant to Article 6(1 f) GDPR not just to take into account 
the actual disadvantages of data processing for data subjects, but also, for the same 
reasons, the potential risks of data processing (see above para. 767). 

913 Above all, however, the balanced consideration of welfare effects within the framework 
of the balancing of interests under antitrust law must be countered by the fact that the 
breach of legal protection provisions which are intended to benefit users cannot be 
justified. The provisions set forth in data protection law provide users not with mere 
economic assets but with fundamental rights of freedom which personal data they are 
willing to disclose. If this personal responsibility is not guaranteed as a result of a 
dominant company’s conduct, this company should not claim that the loss of personal 
responsibility (from its own perspective) is offset by the benefit of its own performance, 
making it acceptable. 

III. Abuse pursuant to Article Art. 102 TFEU 

914 Pursuant to Article 3 para. 1 sentence 2 of Regulation 1/2003, where the competition 
authorities of the Member States or national courts apply national competition law to 
any abuse prohibited by Article 102 of the TFEU, they shall also apply Article 102 of 
the Treaty. According to the catalogue of facts set forth in Article 102 sentence 2 lit. a 
TFEU, any abuse may consist in directly or indirectly imposing unfair purchase or 
selling prices or other unfair trading conditions. However, the examination has shown 
that the concept of protection developed by German case law on the general clause of 
Section 19(1) GWB, which relies heavily on decisions about values based on both 
fundamental rights and ordinary law in order to determine abusive conduct, has so far 
found no equivalent in European case law or application practice. The intended 
prohibition is therefore based on Section 19(1) GWB in conjunction with the relevant 
domestic case law. Pursuant to Article 3(2) sentence 2 of Regulation 1/2003, the 
Member States are not precluded from adopting or applying stricter national provisions 
in their territory in order to prevent or punish unilateral actions by undertakings. 


cf. Tucker, C., “Privacy, Algorithms, and Artificial Intelligence" in: Agrawal A., Gans, J, Goldfarb, A. (publisher). 
The Economics of Artificial Intelligence: An Agenda, Chicago: University of Chicago Press, 2018, 
https://www.nber.orq/chapters/c14011 .pdf (last accessed on 10 January 2019). 

cf. Federal Court of Justice, judgment of 6 November 2013, “VBL-Gegenwert“, KZR 58/11 para. 76 (juris). 
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C. Decision based on Section 32 of the German Competition Act 

915 The decision is lawful on the basis of Section 32 GWB. The main statements made in 
Paragraphs 1 to 4 in the operative part of the decision relate to the infringing conduct 
and the elimination thereof (see I.). They are necessary and proportionate in their 
scope, taking into account the ancillary decisions under Paragraph 5 to 7 (see II). The 
decision also corresponds in all other respects to the dutiful exercise of discretion (see 
III.). 

I. Main statements 

916 The operative part of the decision contains in the basic structure of the main statements 
the prohibition of the use of certain contractual Terms of Service, explained by the 
documents currently used by the parties (Paragraph 1, see 1), and their implementation 
by the actual data processing (Paragraph 2, see 2), as well as the obligation to 
designate and implement the concrete remedial measures required to terminate the 
abusive conduct (Paragraph 3, see 3). Paragraph 4 relating to paragraphs 1-3 clearly 
states that the provision of the service must not be conditional on consent to data 
processing. 

1. Prohibition of the use of provisions in the Terms of Service specified by 
Paragraph 1 in the Data Poiicy and Cookies Poiicy 

917 For a start. Paragraph 1 prohibits the use of Terms of Service, including their 
specification in data and cookies policies, which users must agree to before they can 
begin using the service and which document the intended contractual content.^®® First 
of all, the abusive behaviour is described in variants a) to c) (see a.) and is further 
explained with the current wording of the Facebook Terms of Service and Data Policy 
in the following indents (see b.). 

a. Terms of Service an act of infringement 

918 Abusive conduct consists essentially in the use and implementation of terms of use 
specified by guidelines vis-a-vis a particular group of users ("private users"), the 
provisions of which define certain categories of data processing ("collection", 
combining", "use") with regard to certain types of data ("user and device-related data") 
from certain sources outside the Facebook.com service (Facebook-owned services 
and Facebook Business Tools) and thus results in the combination of largely unlimited 


cf. item 5 of Facebook Terms of Service, according to which the Terms of Service constitute the entire 
agreement. 
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personal data from the above-mentioned sources and their use, in particular the 
combined use by the Facebook.com operating company. 

919 With the reference made in Paragraph 1 of the operative part of the decision to the 
Terms of Service "including the specification in the Data Policy, Cookies Policy or 
similar contractual terms", the Bundeskartellamt has taken into account the current 
practice that the Terms of Service contain only a broad general provision governing the 
processing of personal data, and refers to explanations in a range of other documents 
(para. 95). The documents are usually referred to as "Data Policy" or "Data protection 
guidelines", “Privacy Policy” or the like. There is no standard practice in the internet 
industry with regard to the designation of these documents and the distribution of 
contractual regulatory materials among them. In terms of content, internet companies 
have broad scope for distributing regulations for different types of documents (e.g. 
terms of use, data policy, cookies policy, FAQs, licensing conditions). 

920 There is also wide scope for continuously changing such terms of use, as online 
business models also distribute documents in electronic form, which provides 
centralised, rapid and straightforward opportunities for amendments. Last but by no 
means least, it should be noted that terms of use are often intended to record and 
safeguard certain behaviours without specifying them vis-a-vis the user (see also b.). 
Paragraph 1 of the operative part of the decision therefore covers "comparable 
contractual terms" which is meant to refer to these above-mentioned circumstances. In 
this respect, the prohibition goes beyond the concrete current form of infringement and 
extends to all documents with provisions corresponding to Paragraph 1, irrespective of 
how they are designated and which provisions or explanations are listed in which 
documents. In addition. Paragraph 1 establishes the connection between the concrete 
designation of the abusive conduct and the current contractual provisions intended to 
cover and safeguard it. In this respect, the reference made to the current contractual 
provisions explains the prohibition (see b. for more details) without actually restricting 
it. Restricting the operative part of the decision to the concrete type of infringement 
would, as outlined above, create considerable possibilities for circumvention. 

921 "Private users" are the natural persons who use Facebook.com with a personal profile 
page and a personal Facebook user account (para. 21). It is not relevant whether the 
users also use the personal profile page for professional or commercial purposes or 
whether they also operate a company website. The term does not cover use of a 
Business Manager account (para. 34, 38). Users are resident in Germany if they have 
their permanent residence in Germany (Section 7 of the German Civil Code). In 
connection with the use of services other than Facebook.com, the term "private user" 
refers to any user who is also a private user of the Facebook.com service, i.e. who 
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operates a personal profile page. This also includes cases in which a user of Facebook- 
owned end customer services and of websites that have integrated Facebook Business 
Tools is not yet a private user of Facebook.com when the data is collected and stored, 
but this data is subsequently combined with a personal profile following registration with 
Facebook. 

922 The data processing procedures imposed, namely "collection, "combining" and “use" 
describe data processing categories involving individual data processing procedures 
and phases, each of which is associated with the receipt, analysis, and usable storage 
of data ("collection"), the assignment, in various forms, to existing Facebook data 
(“combining"), and "use" of this data (see above para. 580). The Bundeskartellamt has 
used these terms, some of which have been coined under data protection law, to 
describe the conduct objectively and in accordance with the principle of certainty, in 
order to clearly reflect the essence of the infringing conduct, in particular with regard to 
the merging and combination of data. To this end, it was imperative to depart from the 
often much less clear nomenclature of the terms of use, which record and safeguard 
the relevant procedures without giving the user any details (see also b.). In particular, 
the assignment of data to Facebook user accounts via common identifiers in itself is to 
be understood as “combination”. Facebook claims it does not create profiles within the 
meaning of individual data records which are each expanded when additional data are 
added.'^^® Rather, according to the current database structure, the individual data is 
provided with identifiers such as the Facebook ID or other unequivocal characteristics 
that are stored throughout the entire database and is, if necessary, retrieved for a 
specific use during implementation, based on whatever task the algorithm is to perform. 

923 The prohibition also covers any limited use of data from the above-mentioned sources 
by the operating company of Facebook.com, unless the order - as in the case of data 
collected from Instagram (see below for more details) - expressly prohibits “combined 
use”. Moreover, the Bundeskartellamt did not specify any specific uses. Rather, the 
collection and combination of data is not justified by any of Facebook's purposes and 
interests that were not specified in detail at the time of the decision, thus ruling out an 
ex officio restriction. This means the collection of data including the assignment to 
Facebook user accounts is already prohibited, as is the case with regard to, but not 
limited to, all other uses which the assignment of data might lead to. The mere non-use 
of data collected and assigned for specific purposes, such as profiling (para. 582) - 
does not, according to the justification at the time of the decision, lead to admissibility 
of the collection and combination of data, in particular with regard to the necessity of 
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the data processing subject to examination in each case, without users’ consent, unless 
new facts are presented for this purpose in the implementation proceedings. 

924 The "operating company of Facebook.com" is the company owned by Facebook, which 
offers the Facebook.com service according to the imprint in Germany. This is currently 
Facebook Ireland Ltd., Dublin. This dynamic designation, which can be determined 
from the imprint in Germany in each case, serves to ensure the order applies also to 
intra-group restructuring. 

925 The reference made to "user and device-related data" highlights the fact that this not 
only involves information which, according to its content, relates directly to the person, 
such as identity, interests, living conditions, communication contents or behaviour of 
the user ("user-related data"), but also technical data in the broadest sense, that refer 
to the terminal devices used by the user as well as software and other contents stored 
on them. This "device-related data" can indirectly reveal information about the user, 
such as location-related information, physical movements which are generated via the 
positioning data or mobile device sensors, creating a user movement profile. In 
addition, device-related data can be used to uniquely identify the device itself and 
assign it to a specific user (para. 570). Device-related data therefore encompass all 
information about the properties of a mobile device (such as screen size, other 
elements of the hardware configuration such as processor cores) about the software 
on the mobile device (such as information about the operating system and application 
software installed, browser information) or information stored - even briefly - on the 
mobile device (e.g. browser history, address book, cookies etc.) or data that are emitted 
by the mobile device (e.g. information about the type of signal output such as WLAN, 
Bluetooth etc.). 

926 According to Paragraphs 1 .a. and b., data sources are Facebook-owned end customer 
services, which Facebook provides in addition to Facebook.com. In that regard, the 
Bundeskartellamt no longer included the Onavo service in its decision after it amended 
its data processing conditions. In addition, a distinction had to be made for Facebook- 
owned retail services between the WhatsApp, Oculus, and Masquerade services, on 
the one hand, and Instagram, on the other. The former services are all offered by a 
company belonging to the Facebook Group other than Facebook.com (para.Sff.). 
Instagram like Facebook.com, on the other hand, is offered by Facebook Ireland Ltd. 
This distinction was addressed by the Bundeskartellamt in that, contrary to Paragraph 
1 .b.. Paragraph 1 .a. is based on the fact that the operating company of Facebook.com 
also collects the data categories concerned using an internal transfer process between 
companies belonging to the group that is relevant in terms of data protection law. Data 
processing procedures involving the transmission and receipt of data from other 
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companies belonging to the group are also subject to justification (para. 593ff). In the 
case of Instagram, there is no such processing as the data categories concerned, which 
are collected by Facebook Ireland Ltd., are also collected when using Instagram and 
no additional intra-group reception process takes place. The combination with 
Facebook data, on the other hand, is covered by the operative part of the decision. The 
prohibition of the imposed use of Instagram data has been limited to combined use, 
since the use of Instagram data is not the subject matter of the proceedings, in 
particular for the operation of Instagram by the joint operating company. By contrast, 
the prohibition also applies to the use of data imposed together with the Facebook data 
obtained on the basis of Facebook's dominant position in the market. 

927 Paragraph 1 .c. relates to the processing of data collected from Facebook Business 
Tools imposed, if it is carried out via social plugins (para. 56ff.), Facebook Login and 
Account Kit (para. 63ff.) and via the Facebook pixel or Facebook SDKs for 
measurement and analytics services (para. 67ff.). The fact that Paragraph 1 c) also 
addresses the group’s own provider of Facebook Business Tools as the data 
processing recipient of user and device-related data ensures that organisational 
restructuring involving Facebook Business Tools will not lead to data collected from 
third-party sources being combined with the data collected and stored when 
Facebook.com is used. The Bundeskartellamt has thus addressed the possibility of 
having separate systems^^^ within the framework of considerations to introduce a “clear 
history” function although it is not clear whether this would involve separation in 
organisational terms. 

928 The main statement of Paragraph 1 in all variants is limited to the data processing 
imposed “without the consent” of the data subject. The Bundeskartellamt has therefore 
taken the fact into consideration that the actual extent of the data processing imposed 
can only be justified if users give their consent voluntarily. In addition, there is generally 
no violation under antitrust or data protection law if the data processing is based on 
sufficient self-determination on the part of the user. This is because the actual act of 
infringement involves conditions that are imposed unilaterally on the opposite market 
side and these terms have also been externally determined by a company that has a 
dominant position in the market. Under the GDPR, an objective justification of data 
processing is to be examined in principle under the aspect whether the data processing 
is permissible without voluntary consent on the basis of legal justification, by way of 
exception. The right of informational self-determination does not provide a basis for an 
absolute prohibition of data processing even if the data subjects have given their 
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effective consent. The rulings submitted by the national data protection authorities are 
therefore also limited to the prohibition of certain data processing procedures 
implemented without users’ consent. 

929 In understanding the notion of consent, it should be taken into account that the consent 
currently obtained from data subjects within the framework of their privacy settings for 
the limited use of data collected from Facebook partners (para. 642ff.) and the blocking 
of cookies and advertising IDs (para. 646ff.) does not represent sufficient consent. The 
Bundeskartellamt also defines consent in Paragraph 4 as meaning that the parties 
referred to in Paragraphs 1 -3 may not make the provision of the Facebook.com service 
conditional on the granting of consent. For when the provision of service is made 
conditional on consent to data processing as in this particular case, there is reason to 
assume that consent is not given voluntarily particularly in view of the fact that 
Facebook has a dominant position in the market (para. 634ff.). The Bundeskartellamt 
has refrained from issuing further specifications in the current order with regard to the 
specific structure of consent - for instance in terms of special data categories. They 
would need to be examined in separate proceedings. 

930 It was not an option to impose an additional restriction on the reach of Paragraph 1 .c. 
to the case in which Facebook acts as the data controller pursuant to the GDPR. This 
would not apply to effectively agreed processing on behalf of the controller. It is 
sufficiently clear from the reasons given for the decision that the prohibited infringement 
is based on the data protection assessments and that - in addition to other prerequisites 
such as personal data and data processing - Facebook must be held accountable. The 
Bundeskartellamt did not consider the agreement referred to as "processing on behalf 
of the controller" to be effective (para. 602ff.). 

b. Current conditions and guideiines 

931 The Bundeskartellamt explains the variants described in Paragraphs 1 .a. to c. with the 
indents a to c below based on examples of the Terms of Service and policy contents 
used by the parties at the time the decision was taken in relation to the processing of 
data collected from Facebook-owned services and the Facebook Business Tools that 
is relevant in this context. 

932 First of all, it describes the current regulatory system in which the parties use a broadly 
formulated regulation on data processing in the Terms of Service (Paragraph 2 (1) and 
refer to the Data Policy for further details, which in turn refers to the Cookies Policy. 
The data processing procedures imposed by Facebook that are affected by the decree 
currently result exclusively from these policies. 
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933 As such, the first indent says that the parties stipulate in the Data Policy that they can 
collect user- and device-related data from the data sources mentioned in Paragraphs 
1 a. to c., which are designated "Facebook Products" and "Facebook partners". 

934 The facts outlined in the second indent make it clear that according to Facebook's Data 
Policy, all data collected can be used and "combined” across all Facebook Products. 
This reflects the combination and also combined use of data, which the 
Bundeskartellamt paraphrases as "combining" and as part of the "use" of data in 
Paragraph 1. It also becomes clear that information about users' activities "on devices" 
can also be used and combined (cf. Indents 6. and 7. below). 

935 The third indent makes it clear that according to Facebook's Data Policy, all available 
data can be combined and also used for the company’s measurement and analytics 
services. 

936 The fourth indent says that, according to the Data Policy, all the available data - also 
combined - can be used for the purposes specified therein, including for security and 
research purposes. 

937 The fifth indent shows, albeit limited to the data sources mentioned in Paragraph a. 
("Facebook Companies"), that the data collected and stored there during use are 
collected and combined in accordance with Facebook's Data Policy. Here it says "as 
permitted by applicable law and pursuant to their Terms and Policies". The actual 
implementation - in this connection reference is made to Paragraph 2 - shows 
Facebook's understanding of legal permissibility. A restriction on the transfer and use 
of data based on an agreement with the Information and Data Protection Commissioner 
is found only with respect to the WhatsApp service, which is described in WhatsApp's 
"FAQs," but not in WhatsApp's Terms of Service, Facebook's Terms of Service, Data 
Policy or Cookies Policy (para. 122). 

938 The sixth indent indicates that according to the Cookies Policy, user and device-related 
data can be collected from the data sources mentioned in Paragraph 1 ("Facebook 
Products", "Facebook Companies") and, in the case of the Facebook Business Tools, 
this takes place without any action on the part of the user. This also shows that with 
the social plugins as well as Facebook Login and Account Kit a data flow also occurs 
even if the user does not press the corresponding buttons on the website or app in 
which they are embedded (para. 144). 

939 The seventh indent indicates that under the Cookies Policy, data collection is not limited 
to reading cookie data, but that it includes device-related information, including the 
software used and user activity on users’ own devices off Facebook.com. This shows 
that it is also possible to track users without setting a cookie via the other device 
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identifiers (see para. 155) and that the Terms of Service permit identification of the user 
and matching with existing data via browser or device fingerprinting para. 570). 

2. Prohibition of the impiementation of the Terms of Service, Paragraph 2 

940 Paragraph 2 prohibits the actual implementation of the Terms of Service, which at the 
same time shows the parties' understanding of their own Data Policies and further 
substantiates the intended contractual contents. Investigations show in particular that 
this concerns the specific data collected from Facebook-owned services and Facebook 
Business Tools that are linked in various ways to Facebook user accounts and are 
available for use. 

941 The user data listed for the individual services, which are the subject of the 
implementation of the Terms of Service, are based on the Data Policies of the services 
and on the answers of the parties to the question posed in the information decisions 
regarding the data collected specifically from internal group services and Facebook 
Business Tools. The list is not exhaustive, but serves as an explanation [...]. 
Facebook’s claim that the Bundeskartellamt is not taking actual data processing into 
account is incorrect. The very fact that Facebook provides user and device-related data 
as examples clearly shows the wide scope of the Terms of Service and Data Policies. 
In addition, the Bundeskartellamt determined in each case how the data is assigned to 
the respective Facebook accounts. In this respect, too, the Bundeskartellamt has 
limited itself to creating a list of examples, as there are a number of possibilities 
available and the aim is to record each assignment procedure in order to avoid 
circumvention. 

942 The data listed in paragraph 2.a. for the WhatsApp service are derived from the "FAQs" 
provided by WhatsApp (see para. 123) and from the investigations carried out at 
Facebook. According to Facebook, the data is currently assigned to the respective 
Facebook user accounts via the Family Device ID that WhatsApp installs on the users' 
devices (see para. 125 above). The latter is reflected particularly by the placement of 
cookies on the users' computer described in the Cookies Policy (above 6th and 7th 
indent) including data stored by Facebook on the users' web browser or device, 
identifiers associated with the users' device, and other software. 

943 The data listed in Paragraph 2.b. for the Oculus and Masquerade services are derived 
from the respective Data Policies and from the investigations at Facebook. The above- 
mentioned data, according to Facebook, is assigned to Facebook user accounts either 
via the Facebook Login, e-mail addresses or device IDs (see above para. 134ff.). 
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944 The Instagram data listed in item 2.c. are based on Instagram's Data Policy and 
investigations at Facebook (para. 127f.) According to Facebook, the data are assigned 
via the Family Device ID. 

945 The data listed in Paragraph 2.d. on Facebook Business Tools are based in particular 
on Facebook’s replies (see above para. 144ff.). According to Facebook, they represent 
"minimum data records" or "standard information" and are therefore not exhaustive, but 
have merely been given as examples. On the one hand, this involves a large number 
of device-related data and device IDs as described above. User-related data is 
collected in particular via SDKs or the Facebook pixel with the so-called "Events", which 
relate to the user interactions with the mobile app or website and can be configured in 
a variety of ways (see para. 70, 73, 147, 150 above). The data collected are assigned 
to Facebook accounts in various ways. It is currently done via cookie data that contain 
various identifiers, such as a pixel ID or Facebook ID (see above para. 152), via device 
identifiers, advertising IDs and other device-related metadata (para. 154, 155) or via 
hashed identifying plain user data within the scope of so-called “advanced matching” 
(para. 153). Here, too, the list of assignment procedures is by no means exhaustive. 

3. Obligation to terminate the infringement, Paragraph 3 

946 The Bundeskartellamt also requires the parties to implement various measures to 
terminate the antitrust infringement. 

947 Paragraph 3.a. contains an obligation to terminate the infringement, to remove and 
amend the Terms of Service and to implement them within a period of 12 months. 

948 Paragraph 3.b. contains a few specifications for the amendment of the Terms of 
Service, including the Data Policies that specify these terms of use, within the same 
period of time, requiring the parties to expressly clarify vis-a-vis private users that user- 
related data from the sources concerned will not be collected, combined or used without 
their consent. The Bundeskartellamt hereby uses a common practice in the privacy 
statements, which WhatsApp also uses, for instance, in relation to reading encrypted 
data or Onavo. This obligation is also based on the justification available at the time 
the decisions were taken. Insofar as solutions conforming to antitrust law are put 
forward in the implementation procedure, the Bundeskartellamt will consider these as 
new facts and adjust the clarification obligation accordingly. 

949 Paragraph 3.c. finally contains the obligation to submit an implementation road map 
within 4 months of the decision being served, which describes and explains in detail 
the solution proposals as well as the individual elements and steps involved, indicating 
the planned date of implementation. In this respect, the Bundeskartellamt is responding 
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to the parties' submission that the solution in the previously envisaged solution 
scenarios presents a technical challenge that would take several months to resolve. 
The implementation road map must include a detailed description of the solution, the 
necessity thereof and the technical steps involved. This also includes the press release 
of the parties' plan to integrate Facebook, WhatsApp, and Instagram more closely.^^® 

II. Necessity and proportionality according to Section 32 of the Act on Restraints of 
Competition 

950 The obligations to terminate the infringement are necessary and proportionate to the 
extent outlined in the operative part of the decision. 

951 In particular, the obligations were not to be limited to an acceptable level of data or 
categories of data, taking into account the different data uses listed by the parties. Nor 
can they be limited to individual data processing procedures - for example, use of data 
only for certain purposes. This is because the Terms of Service and the policies 
specifying them refer to all the information about the user and device-related data the 
parties collect from the above-mentioned sources and that can be collected, combined 
and used without restriction for all the of the above-mentioned purposes. However, 
such comprehensive data processing can only be justified if users give their consent 
voluntarily. 

952 In addition, it had to be taken into account that at the time the decision was taken the 
parties had not provided sufficiently objective justifications for any of the data 
processing procedures imposed for all of the user- and device-related data at issue 
here and the explanations they put forward had no objective justification. It was not 
substantiated either what data is necessary for what purposes or what the purposes 
specifically involve. Facebook's statement is limited to claiming that all data are 
necessary for all purposes from all data sources at issue here, in particular for the 
personalisation of the service and advertising. Since according to the case law of the 
European Court of Justice objective justification is required for all data processing 
procedures - as the parties themselves argue - the parties who are subject to the 
burden of proof, at least in terms of explanation and data protection law, did not have 
objective justifications available at the time of the decision. This means the data 
processing at issue here infringes the prohibition of abusive practices with regard to all 
user- and device-related data in the data processing categories described, irrespective 
of the purposes mentioned, taking into account the data protection assessments. In 
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order to terminate the infringement, the extent imposed in the prohibition is therefore 
necessary - limited to the lack of consent. 

953 The open obligation to terminate the infringement, to amend the Terms of Service set 
out in Paragraph 3.a. and to implement them under Paragraph 3.b. and c. that extend 
beyond the obligation to amend the Terms of Service are also necessary for the 
effective termination of the infringement and are permissible under Section 32(2) GWB. 

954 It would not be sufficient for effective termination of the infringement on the one hand 
or proportionate on the other to merely prohibit implementation. The open wording is 
necessary because the parties involved can choose at their own entrepreneurial 
discretion the remedy to terminate the infringement that conforms to antitrust law. The 
antitrust authority is unable and is not permitted to impose a specific solution. The order 
is therefore limited to specifying an implementation period of 12 months for termination 
of the infringement. The timeframe of 12 months takes the parties' statement into 
consideration that the technical challenge could take several months to complete. 

955 The obligation to clarify the issues according to Paragraph 3.b ensures that the 
restriction of data processing from sources outside Facebook.com will be made 
sufficiently transparent vis-a-vis users and that a clear, binding and enforceable 
agreement will be reached with the user in this respect. The decision is necessary and 
appropriate as a means of eliminating the consequences, especially since the users 
concerned are private individuals who would otherwise continue to be affected by the 
old Terms of Service to an even greater extent. Here, too, the Bundeskartellamt 
considers it necessary to take into account a consent solution with the requirements 
set out in Paragraph 4, as it does for Paragraph 1. If the parties involved in the 
proceedings implement further solutions that comply with antitrust law and submit 
objective justifications, in advance and in detail, the Bundeskartellamt will take this into 
account as a new fact. 

956 Furthermore, with regard to possible solutions that comply with antitrust law, it is 
necessary and proportionate for the effective termination of the infringement to oblige 
the parties involved in Paragraph 3.c to submit an implementation road map as an initial 
step within the overall implementation period, which describes and explains in detail 
the solution proposals as well as the individual elements, steps and timeline involved. 
This is also necessary in order to be able to take into account the changed 
circumstances and/or to adjust deadlines within the scope of the revocation 
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reservation. The four-month deadline for this is appropriate and necessary in order to 
ensure speedy and structured implementation. 

957 Contrary to Facebook's view, the prohibition and the obligation to terminate the 
infringement to the extent outlined in the operative part of the decision are by no means 
disproportionate. The extent to which there is a risk of fundamental, irrevocable and 
entirely disproportionate consequences if Facebook has to amend unacceptable Terms 
of Service and Data Policies within a reasonable period of time is not evident. Facebook 
apparently argued as much in the event that it had been obliged to terminate the 
infringement without any implementation deadline. 

958 The assumption made in Facebook's statement in response to the statement of 
objections that the Bundeskartellamt is imposing prohibitions that are disproportionate 
to the concerns expressed is incorrect. Restricting the prohibition or the obligation to 
terminate the infringement to an extent permissible under data protection law based on 
various parameters (extent of the data, type of data, type of data processing, purpose 
limitation, anonymisation, effective processing on behalf of the controller, user control 
options, retention periods, protective measures, etc.) is, as described above, out of the 
question and would actually constitute an infringement of the principle of 
proportionality. Unlike quantitative abusive pricing, it is inconceivable to specify an 
"abuse limit" in the case of qualitative abusive terms due to infringements of the law. 
On the contrary, in relation to Paragraphs 1 -3 the parties bear full responsibility for the 
lawfulness of their data processing and thus also for the termination of the infringement. 
It is not true either that the Bundeskartellamt is prohibiting “on Facebook” data 
processing. During the entire proceedings, the Bundeskartellamt made it clear, also in 
the preliminary assessment of 19 December 2017, that Facebook-owned services are 
deemed to be “third-party sources”. Furthermore, limiting the subject-matter of the 
proceedings to off-Facbook data sources is a matter of discretion for the 
Bundeskartellamt and is not the result of any legal considerations. 

959 Paragraph 5 of the operative part of the decision allows the parties in relation to 1 to 3 
to apply for interim proceedings before they have to start preparing to implement the 
order. Once the interim proceedings have been brought to a conclusion at a court of 
first instance, the parties still have almost the entire implementation period of 12 months 
provided for in the order if they file an application for suspensive effect pursuant to 
Section 65 (3) sentence 3 GWB when they file an appeal in the main proceedings. In 
that regard, by giving two months' notice, the Bundeskartellamt has taken into account 
the statutory time-limit for substantiating reasons for an appeal in the main 
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proceedings. Paragraph 5 sentence 2 of the operative part of the decision covers all 
cases of dismissal of the interim proceedings by the court of first instance. If the interim 
proceedings are terminated by a court decision on the merits, the date of that decision 
shall be authoritative. Where the summary proceedings are terminated by process 
declarations, the date of receipt by the court of the process declaration bringing about 
the termination will be authoritative. The reservation of complete or partial revocation 
in Paragraph 7 also extends to Paragraph 5 of the operative part of the decision and 
allows the regulation to be adjusted if this appears to be appropriate during the course 
of the interim proceedings, in the light of appreciable interests of the parties involved 
or in the public interest in enforcement. An adjustment of the provision is particularly 
worth considering if preliminary rulings pursuant to Article 267 para.2 TFEU are to be 
delivered in interim proceedings. 

960 The Bundeskartellamt does not see any need for the antitrust authorities to suspend 
the order pursuant to Section 65 (3) sentence 2 GWB at this point in time. The basic 
issues raised by the parties particularly regarding the competency of the 
Bundeskartellamt and the basic issues of abusive business terms can be sufficiently 
clarified as legal issues in advance within the framework of interim proceedings based 
on summary examination. It is not assumed, however, that this case is a “pilot judgment 
procedure” that could be subject to serious legal doubts in view of the recent case law 
of the Federal Court of Justice in the VBL Gegenwert and Pechstein cases. 

961 Paragraph 7 regulates a reservation of full or partial revocation that applies to all rules 
of the order. The reservation of revocation means the decision can be adapted flexibly 
to changed circumstances. This includes, in particular, the taking into account of 
various solution possibilities that cannot be imposed within the framework of the 
decision for reasons of proportionality. In addition, the possibility of adjusting the 
implementation deadlines and suspending them, in particular with regard to the 
solutions proposed by Facebook, adjusting the different time frames required in each 
case, as the case may be, and with regard to the lodging of further legal remedies, is 
necessary and proportionate. After all, this allows for a flexible and rapid response to 
changing market conditions and innovations in Internet services, the technical and 
commercial dynamics of which are unpredictable. The Bundeskartellamt has therefore 
refrained from ordering a fixed period of validity for the order. 


III. Other discretionary powers 

962 The Bundeskartellamt exercised its discretionary power by prohibiting abusive 
practices pursuant to Section 32 GWB. The Bundeskartellamt thus considers it to be in 
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the public interest to enforce antitrust measures to terminate the infringement of data 
protection law resulting from market power. 

963 As such, in the Bundeskartellamt’s opinion, the public interest in carrying out an 
antitrust review of Facebook's data processing is limited to the imposed collection of 
personal user data from Facebook's own services and Facebook Business Tools 
described above, together with the assignment of these data to respective Facebook 
user accounts and the use of any such data. These terms and conditions have 
considerable reach since the market power Facebook has by collecting data extends 
beyond the social network, affecting consumers’ use of the internet. 

964 The Bundeskartellamt also thinks there is a limit to the importance for consumers of 
the efficiencies of a business model based on personal data and personalised 
advertising in respect of the processing of data from sources outside Facebook.com. 
The provision of a social network free of charge that is funded by advertising is also of 
high benefit for consumers. Both the functionalities of a social network and the fact that 
it is financed through advertising, in principle, imply a high degree of processing of 
personal data. 

965 However, the Bundeskartellamt holds that the efficiencies in a business model based 
on personalised advertising do not outweigh the interests of the users when it comes 
to processing data from sources outside of the social network. This applies in particular 
where users have insufficient control over the processing of their data and the 
assignment of this data to their Facebook user accounts. As far as this part of data 
processing is concerned, intervention from a competition law perspective is appropriate 
from the Bundeskartellamt’s point of view because the data protection boundaries set 
forth in the GDPR were clearly overstepped, also in view of Facebook’s dominant 
position. 

966 In the present case, this does not conflict with the fact that data protection authorities 
and consumer associations can also take action against Facebook's infringements 
based on their legal bases. Rather, it makes sense for market dominance to be 
determined and established by the Bundeskartellamt itself leveraging its powers to 
provide information and within the differentiated framework of antitrust law. This 
approach is welcomed by the Federation of German Consumer Organisations (VZBV) 
as well as by the data protection authorities 
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Instruction on rights of appeal: 

This decision is subject to appeal. The appeal should be submitted in writing to the 
Bundeskartellamt, Kaiser-Friedrich-StraBe 16, 53113 Bonn within one month upon service of 
the decision. Receipt of the appeal by the appellate court, the Dusseldorf Higher Regional 
Court, within this time limit is, however, also sufficient. 

The reasons for the appeal should be presented in a written statement and submitted to the 
Bundeskartellamt or the appellate court. The time limit for filing the statement of appeal is two 
months. It shall begin upon receipt of the decision under appeal and may, upon application, be 
extended by the presiding judge of the appellate court. The statement of appeal must state the 
extent to which the decision is being appealed and its modification or revocation sought and 
indicate the facts and evidence (if applicable, also new facts) on which the appeal is based. 

The notice of appeal and the statement of the reasons of appeal must be signed by a lawyer. 

The appeal has no suspensive effect. The appellate court may, upon application, entirely or 
partly restore the suspensive effect of the appeal. 


Topel 


Judith 


Dr Sewczyk 
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